T09 · Insecure Skill Coding Practices
Error
- Location
- scripts/forecast.sh:6
- Finding
- API Key Disclosure Through an Unrestricted Forecast API Host Override## Vulnerability Details **File Location**: `scripts/forecast.sh:6-22` **Vulnerability Type**: Credential disclosure through an attacker-controlled network destination **Risk Level**: High ### Vulnerable Code ```bash HOST="${WEATHER_ENSEMBLE_HOST:-https://polymarket-scanner.fly.dev}" API_KEY="${WEATHER_ENSEMBLE_API_KEY:-}" CITY="${1:?Usage: forecast.sh <city> [YYYY-MM-DD]}" CITY=$(echo "$CITY" | tr '[:upper:]' '[:lower:]' | sed 's/[^a-z0-9 -]//g' | sed 's/ /%20/g') DATE=$(echo "${2:-}" | sed 's/[^0-9-]//g') CURL_ARGS=(-s -w "\n%{http_code}") if [ -n "$API_KEY" ]; then CURL_ARGS+=(-H "X-API-Key: $API_KEY") fi URL="${HOST}/forecast/${CITY}" if [ -n "$DATE" ]; then URL="${URL}?target_date=${DATE}" fi RESPONSE=$(curl "${CURL_ARGS[@]}" "$URL") ``` ### Technical Analysis The destination host is read from `WEATHER_ENSEMBLE_HOST` without validating its scheme, hostname, port, or embedded credentials. When `WEATHER_ENSEMBLE_API_KEY` is set, the script unconditionally attaches that secret to the resulting request as an `X-API-Key` header. Consequently, an environment value can redirect the request—and its API key—to an arbitrary server. Supplying an `http://` URL additionally permits plaintext credential transmission. This behavior exceeds the minimum network privilege required for the declared functionality, which only needs to contact `https://polymarket-scanner.fly.dev`. It also conflicts with the security statement in `SKILL.md`, which claims that all requests are sent to the named service via HTTPS. ### Attack Path 1. An attacker, compromised launcher, or unsafe runtime configuration sets `WEATHER_ENSEMBLE_HOST` to an attacker-controlled URL, such as `https://attacker.example`. 2. A legitimate credential is available through `WEATHER_ENSEMBLE_API_KEY`. 3. The user or Agent invokes the forecast command. 4. The script constructs the forecast URL from the attacker-controlled host. 5. ...[truncated 844 chars]
- Remediation
- ## Remediation Suggestions 1. Remove `WEATHER_ENSEMBLE_HOST` from production execution and use a constant endpoint: ```bash readonly HOST="https://polymarket-scanner.fly.dev" ``` 2. If an override is genuinely required for development, validate the parsed destination before adding the API-key header. Require: - The `https` scheme. - The exact hostname `polymarket-scanner.fly.dev`. - No embedded username or password. - No unexpected port. - No redirection to a different origin. 3. Add restrictive curl options: ```bash curl --proto '=https' --tlsv1.2 --fail-with-body ... ``` 4. Disable redirects or ensure credentials are never forwarded across origins. If redirects are needed, validate every destination and do not use options such as `--location-trusted`. 5. Build the URL first, validate its origin, and only then append the `X-API-Key` header. 6. Update `SKILL.md` to accurately document any supported endpoint override and its security restrictions. 7. Add automated tests verifying that HTTP URLs, alternate domains, embedded credentials, and unexpected ports are rejected before any network request occurs.