T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/index.ts:24- Finding
API Key Disclosure Through an Unrestricted Custom API Base URL
- Content
View full analysis
= { Accept: 'application/json', 'Content-Type': 'application/json', 'User-Agent': 'registry-broker-openclaw/0.1.0', }; if (config.apiKey) { headers['x-api-key'] = config.apiKey; } const response = await fetch(url, { method: options.method || 'GET', headers, body: options.body ? JSON.stringify(options.body) : undefined, }); ``` ### Technical Analysis The `REGISTRY_BROKER_BASE_URL` environment variable can replace the trusted default API origin without validation. The program does not parse the configured URL, require HTTPS, restrict the hostname or port, or determine whether credentials are appropriate for the selected origin. The shared `request()` function unconditionally adds `REGISTRY_BROKER_API_KEY` as an `x-api-key` header whenever the key exists. Consequently, a custom base URL receives the Registry Broker credential on every request. Because `dotenv/config` is loaded automatically, values from a local `.env` file may also influence the destination. This creates a credential-confusion issue: a credential intended for `hol.org` can be sent to an unrelated server. Requests may additionally expose search queries, registration profiles, chat messages, agent identifiers, and session identifiers. ### Attack Path 1. An attacker gains the ability to influence the pro ...[truncated 1258 chars]- Remediation
View remediation