T09 · Insecure Skill Coding Practices
Error
- Location
- SKILL.md:25
- Finding
- Trade-Authorizing Bearer Credential Can Be Redirected to an Arbitrary Server<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:25-30, 62`; duplicated in `skills/xxyy-trade/SKILL.md:26-31, 63` **Vulnerability Type**: Unrestricted credential destination **Risk Level**: High ### Vulnerable Code ```markdown - `XXYY_API_KEY` (required) -- Your XXYY Open API Key (format: `xxyy_ak_xxxx`). - `XXYY_API_BASE_URL` (optional) -- API base URL, defaults to `https://www.xxyy.io` ## Authentication All requests require header: `Authorization: Bearer $XXYY_API_KEY` ``` ```markdown `POST ${XXYY_API_BASE_URL:-https://www.xxyy.io}/api/trade/open/api/swap` ``` The same configurable base URL is used throughout the Skill for authenticated ping, wallet, token-query, trading, and token-launch requests. ### Technical Analysis The Skill permits `XXYY_API_BASE_URL` to control the destination of requests while requiring the wallet-authorized bearer credential to be attached to every request. It does not require HTTPS, validate the destination hostname, or define an origin allowlist. The Skill explicitly states that the API key can execute real on-chain trades using custodial wallet balances. Consequently, this is not merely a read-only information token: disclosure can grant an attacker authority to initiate financial operations. An attacker who can influence the inherited process environment, runtime configuration, container configuration, or launch command can set the base URL to an attacker-controlled endpoint. Subsequent Skill activation or use then transmits the bearer credential to that endpoint. ### Attack Path 1. The attacker gains the ability to set or influence `XXYY_API_BASE_URL` in the Agent's environment. 2. The attacker sets it to an endpoint under their control, such as `https://attacker.example`. 3. The user activates the Skill or requests any supported API operation. 4. The Agent constructs the request using the attacker-controlled base URL. 5. The Agent adds `Authorization: Bearer $XXYY_API_KEY`. 6. The attacker's server re ...[truncated 807 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Remove the unrestricted `XXYY_API_BASE_URL` override in production and use a fixed API origin. 2. If configurability is required, validate the normalized URL before sending a request: - Require the `https` scheme. - Require an exact approved hostname, such as `www.xxyy.io`. - Reject embedded credentials, nonstandard ports, fragments, and unapproved subdomains. 3. Configure `curl` so credentials are never forwarded across cross-origin redirects, and reject redirects to unapproved origins. 4. Separate read-only data access from transaction-authorizing access by using distinct, scope-limited credentials. 5. Prefer short-lived credentials with explicit endpoint, wallet, chain, and transaction-value restrictions. 6. Retain IP allowlisting as defense in depth, but do not treat it as a replacement for destination validation. 7. Document credential rotation and revocation procedures for environments where an unsafe base URL may already have been used. 8. Apply the correction to both duplicated Skill definitions to prevent divergent security behavior. ]]>