T09 · Insecure Skill Coding Practices
Error
- Location
- assets/plugin/image-generation-provider.js:20
- Finding
- Hard-Coded Nonstandard API Endpoint Receives Credentials and User Prompts## Vulnerability Details **File Location**: `assets/plugin/image-generation-provider.js`, lines 20–22 and 101–121 **Vulnerability Type**: Unverified external data destination and credential disclosure risk **Risk Level**: High ### Vulnerable Code ```js function resolveHnbcBaseUrl(cfg) { const direct = cfg?.models?.providers?.hnbc?.baseUrl?.trim() || "https://api.1415.xin/v1"; return direct.replace(/\/+$/u, ""); } ``` ```js const apiKey = auth.apiKey || req.cfg?.models?.providers?.hnbc?.apiKey?.trim(); if (!apiKey) throw new Error("HNBC API key missing"); const response = await fetch(`${resolveHnbcBaseUrl(req.cfg)}/images/generations`, { method: "POST", headers: { Authorization: `Bearer ${apiKey}`, "Content-Type": "application/json" }, body: JSON.stringify({ model: req.model || "gpt-image-2", prompt: req.prompt, n: req.count ?? 1, size: resolveRequestedSize(req) }) }); ``` ### Technical Analysis The provider defaults to the nonstandard domain `api.1415.xin` and transmits both the HNBC bearer credential and the user's image-generation prompt to it. The project documentation identifies the service as HNBC but does not disclose this destination domain or explicitly warn that credentials and prompts are sent there. The destination can also be replaced through `models.providers.hnbc.baseUrl` without an origin allowlist or an explicit confirmation mechanism. If configuration can be modified by another local component or untrusted configuration source, the bearer credential and prompt can consequently be redirected to an attacker-controlled HTTPS server. The code does not show an explicit cross-origin redirect policy. Depending on the runtime's Fetch implementation, authorization headers may be removed during cross-origin redirects; however, the project should not rely solely on implicit client behavior to protect credentials. ### Attack Path 1. The user invokes `scripts/install.sh`, which installs the provider into OpenCl ...[truncated 1301 chars]
- Remediation
- ## Remediation Suggestions 1. Verify that the default endpoint is the provider's official, controlled API domain and document that ownership. 2. Clearly disclose the destination domain and the transmission of API credentials and user prompts before first use. 3. Restrict the default endpoint and configurable `baseUrl` to HTTPS. 4. Maintain an allowlist of approved origins. If custom origins are required, require explicit user opt-in and show a warning that the API key will be sent to that origin. 5. Parse the URL with the standard `URL` API and reject embedded credentials, unsupported protocols, unexpected ports, malformed hosts, and unapproved origins. 6. Set an explicit redirect policy such as `redirect: "error"` or manually validate every redirect destination before resending a request. 7. Add automated tests confirming that credentials are never sent to an unapproved origin or forwarded across redirects. 8. Provide credential revocation and rotation guidance for users who may already have used an untrusted endpoint.