T09 · Insecure Skill Coding Practices
- Location
SKILL.md:48- Finding
Configurable MCP Endpoint Can Exfiltrate the API Bearer Token
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 13 and 48–51
Vulnerability Type: Arbitrary credential destination caused by an unrestricted endpoint override
Risk Level: HighVulnerable Code
markdown - `MCD_MCP_URL` (optional) - MCP service endpoint URL (default: https://mcp.mcd.cn)bash curl -s -X POST "${MCD_MCP_URL:-https://mcp.mcd.cn}" \ -H "Authorization: Bearer ${MCD_TOKEN}" \ -H "Content-Type: application/json" \ -d '{"jsonrpc":"2.0","method":"tools/call","params":{"name":"TOOL_NAME","arguments":{...}},"id":1}'The implementation also conflicts with the security claim in
SECURITY.md, lines 87–91:markdown 1. **Hardcoded API endpoint** - Only communicates with `mcp.mcd.cn` - MCD_MCP_URL has a safe default - No dynamic URL construction from user inputTechnical Analysis
The skill places the sensitive
MCD_TOKENvalue in an HTTPAuthorizationheader while allowing the request destination to be selected through the unrestrictedMCD_MCP_URLenvironment variable. A safe default does not provide destination security because any existing value overrides that default.There is no documented or implemented validation requiring HTTPS, checking that the parsed hostname is exactly
mcp.mcd.cn, restricting the port, or otherwise allowlisting the expected origin. Consequently, any party able to influence the skill's environment can redirect authenticated requests to an attacker-controlled endpoint. The token will then be transmitted as a bearer credential before the response is processed.This is an insecure configuration and credential-handling flaw rather than evidence that the reviewed package intentionally sets a malicious endpoint. Nevertheless, it creates a direct credential-exfiltration primitive. The inaccurate statement in
SECURITY.mdmay also cause users to underestimate the risk because the endpoint is not actually hardcoded.Attack Path
- An attacker, compromised lau ...[truncated 1289 chars]
- Remediation
View remediation
Remediation Suggestions
-
Remove the
MCD_MCP_URLoverride if alternate service endpoints are not operationally required:bash curl --fail --silent --show-error \ --request POST "https://mcp.mcd.cn" \ --header "Authorization: Bearer ${MCD_TOKEN}" \ --header "Content-Type: application/json" \ --data "$REQUEST_BODY" -
If endpoint configurability is required, validate the parsed URL before attaching credentials:
- Require the
httpsscheme. - Require the exact hostname
mcp.mcd.cn. - Reject embedded credentials, fragments, unexpected ports, and deceptive suffixes such as
mcp.mcd.cn.attacker.example. - Compare parsed URL components rather than using substring or prefix checks.
- Prefer an explicit allowlist of complete origins.
- Require the
-
Prevent cross-origin credential forwarding:
- Disable redirects with
--max-redirs 0, or strictly validate every redirect destination before following it. - Do not attach the authorization header until endpoint validation succeeds.
- Disable redirects with
-
Apply defense in depth:
- Use narrowly scoped, short-lived, and revocable tokens where supported.
- Run the skill with a restricted execution environment and network egress allowlisting for
mcp.mcd.cn. - Avoid inheriting endpoint configuration from untrusted parent processes or project-local environment files.
-
Correct
SECURITY.mdandREADME.mdso they accurately describe endpoint configurability and its trust assumptions. Do not claim that the destination is hardcoded while an environment variable can override it. -
Add negative security tests that verify requests are rejected for HTTP endpoints, alternate hosts, deceptive hostnames, unexpected ports, malformed URLs, and cross-origin redirects.
-