T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/forge-client.sh:3- Finding
Configurable API endpoint can expose bearer credentials and translation content
- Content
View full analysis
&2 || { echo "❌ Signup failed" >&2; exit 1; } fi [ -z "$API_KEY" ] && { echo "❌ Set TRANSLATEFLOW_API_KEY or TRANSLATEFLOW_EMAIL" >&2; exit 1; } ACTION="${1:-help}"; shift || true case "$ACTION" in translate) curl -sf -X POST "$API_BASE/v1/translate" -H "Authorization: Bearer $API_KEY" -H "Content-Type: application/json" -d "$1" ;; batch) curl -sf -X POST "$API_BASE/v1/translate/batch" -H "Authorization: Bearer $API_KEY" -H "Content-Type: application/json" -d "$1" ;; health) curl -sf "$API_BASE/v1/health" ;; *) echo "TranslateFlow: translate '' | batch '' | health" ;; esac ``` ### Technical Analysis The script permits `TRANSLATEFLOW_API_URL` to replace the trusted TranslateFlow origin without validating the URL scheme or hostname. The selected endpoint receives security-sensitive information: - The configured email address during key registration. - The bearer API key in the `Authorization` header during translation requests. - User-supplied translation or batch content in the request body. An attacker who can influence the process environment can set the variable to an attacker-controlled HTTPS server or a plaintext HTTP endpoint. Subsequent requests will treat that server as trusted and transmit credentials and content to it. Use of HTTP would additionally expose data to network interception. This issu ...[truncated 1557 chars]- Remediation
View remediation