T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/refresh_sources.py:96- Finding
Ambient GitHub Credential Sent During Public Source Checks
- Content
View full analysis
Any: headers = { "Accept": "application/json", "User-Agent": USER_AGENT, } if url.startswith("https://api.github.com/"): headers["X-GitHub-Api-Version"] = "2022-11-28" token = os.environ.get("GITHUB_TOKEN") or os.environ.get("GH_TOKEN") if token: headers["Authorization"] = f"Bearer {token}" request = urllib.request.Request( url, headers=headers, ) with urllib.request.urlopen(request, timeout=timeout) as response: ``` ### Technical Analysis The source-refresh operation queries public GitHub repository and commit endpoints that do not require authentication. Despite this, `fetch_json` automatically reads `GITHUB_TOKEN` or `GH_TOKEN` from the process environment and attaches the selected value as a bearer credential. This behavior exceeds the minimum privilege necessary for checking public metadata. The presence of an ambient environment variable is treated as authorization to transmit it, without an explicit command-line opt-in, confirmation, or token-scope check. It also conflicts with the operating boundary in `SKILL.md`, which prohibits credential access unless explicitly authorized. The destination URLs are fixed to GitHub HTTPS API endpoints, and the script does not print the token. Therefore, there is no evidence of intentional credential theft or transmission to an attacker-controlled endpoint. Nevertheless, unnecessarily introducing a credential into network requests expands the exposure surface. Redirect validation is performed only after `urlopen` returns, rather than enforcing the destination policy before each authenticated request in a redirect chain. ### Attack Path 1. A user or automation environment ...[truncated 1421 chars]- Remediation
View remediation