T09 · Insecure Skill Coding Practices
Warning
- Location
- tests/run_tests.sh:87
- Finding
- Test Suite Can Make Unintended Authenticated Production API Requests<![CDATA[ ## Vulnerability Details **File Location**: `tests/run_tests.sh:87-95` **Related Locations**: `tests/run_tests.sh:16`, `README.md:278-284` **Vulnerability Type**: Failure to enforce test isolation and unsafe credential inheritance **Risk Level**: Medium ### Vulnerable Code ```bash STUBS_DIR="${SCRIPT_DIR}/stubs" ``` ```bash # Run the script with the curl stub injected into PATH. # Sets ANTHROPIC_ADMIN_API_KEY to a fake but valid-format key by default. # Extra env vars can be passed as KEY=VALUE arguments before the script flags. run_script() { local fixture="${STUB_CURL_FIXTURE:-response_ok}" STUB_CURL_FIXTURE="$fixture" \ PATH="${STUBS_DIR}:${PATH}" \ ANTHROPIC_ADMIN_API_KEY="${ANTHROPIC_ADMIN_API_KEY:-sk-ant-admin-test-fake-key-0000}" \ bash "$SCRIPT" "$@" 2>&1 } ``` The repository tree supplied for review contains no `tests/stubs/` directory and no `tests/stubs/curl` executable. This contradicts the test-suite assumption and the statement in `README.md:278-284` that testing requires no credentials or network access. ### Technical Analysis The test harness attempts to intercept HTTP requests by prepending `tests/stubs` to `PATH`. Because the expected `curl` stub is absent, command resolution continues through the rest of the inherited `PATH` and can select the system-installed `curl`. Credential handling compounds the problem: ```bash ANTHROPIC_ADMIN_API_KEY="${ANTHROPIC_ADMIN_API_KEY:-sk-ant-admin-test-fake-key-0000}" ``` The fallback test key is used only when the environment variable is unset or empty. If the user already has a real Anthropic Admin API key exported, the test harness preserves that production credential. The invoked `scripts/usage.sh` can consequently use the system `curl` to send the real key to `https://api.anthropic.com` and perform actual usage-report or model-validation requests. The destination is Anthropic’s official API, not an attacker-controlled service, so this is not evidence of credential ...[truncated 1679 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Package the intended executable curl stub at `tests/stubs/curl` and verify that it is executable. 2. Fail closed before running any tests: ```bash CURL_STUB="${STUBS_DIR}/curl" if [[ ! -x "$CURL_STUB" ]]; then echo "ERROR: required curl test stub is missing or not executable: $CURL_STUB" >&2 exit 1 fi ``` 3. Replace inherited credentials unconditionally with a synthetic test value: ```bash ANTHROPIC_ADMIN_API_KEY="sk-ant-admin-test-fake-key-0000" ``` Do not use the caller’s `ANTHROPIC_ADMIN_API_KEY` as a default for unit tests. 4. Use a minimal controlled `PATH`, or invoke the stub by an explicit absolute path. If PATH-based interception remains necessary, verify resolution: ```bash resolved_curl=$(PATH="$STUBS_DIR" command -v curl || true) [[ "$resolved_curl" == "$STUBS_DIR/curl" ]] || { echo "ERROR: tests are not using the required curl stub" >&2 exit 1 } ``` 5. Add an explicit network-denial mechanism in CI, such as a network-disabled container or sandbox, so accidental calls cannot reach production even if stubbing regresses. 6. Add a regression test that fails if the real `curl` binary executes or if any outbound connection is attempted. 7. Keep the README’s offline-testing claim only after the repository includes and validates the required stub. ]]>