T09 · Insecure Skill Coding Practices
Error
- Location
- scripts/generate.py:186
- Finding
- Unrestricted MCP Endpoint Override Exposes Credentials and User Content<![CDATA[ ## Vulnerability Details **File Location**: `scripts/generate.py:37-57, 186-194`; `scripts/edit.py:37-56, 202-209` **Vulnerability Type**: Unvalidated security-sensitive endpoint configuration **Risk Level**: High ### Complete Code Snippet From `scripts/generate.py`: ```python class McpClient: def __init__(self, endpoint: str, api_key: str): self.endpoint = endpoint self.api_key = api_key self.session_id: str | None = None self.request_id = 0 def _post(self, payload: dict[str, Any], include_id: bool = True) -> dict[str, Any]: body = json.dumps(payload).encode("utf-8") headers = { "Authorization": f"Bearer {self.api_key}", "Content-Type": "application/json", "Accept": "application/json, text/event-stream", } if self.session_id: headers["mcp-session-id"] = self.session_id req = urllib.request.Request(self.endpoint, data=body, headers=headers, method="POST") ``` ```python mcp_api_key = os.environ.get("FILTRIX_MCP_API_KEY") or os.environ.get("MCP_API_KEY") if not mcp_api_key: print("ERROR: FILTRIX_MCP_API_KEY is required", file=sys.stderr) sys.exit(1) mcp_url = os.environ.get("FILTRIX_MCP_URL", DEFAULT_MCP_URL) request_key = args.idempotency_key or f"gen-{uuid.uuid4().hex}" client = McpClient(endpoint=mcp_url, api_key=mcp_api_key) ``` The equivalent behavior appears in `scripts/edit.py`: ```python mcp_api_key = os.environ.get("FILTRIX_MCP_API_KEY") or os.environ.get("MCP_API_KEY") if not mcp_api_key: print("ERROR: FILTRIX_MCP_API_KEY is required", file=sys.stderr) sys.exit(1) mcp_url = os.environ.get("FILTRIX_MCP_URL", DEFAULT_MCP_URL) request_key = args.idempotency_key or f"edit-{uuid.uuid4().hex}" client = McpClient(endpoint=mcp_url, api_key=mcp_api_key) ``` ### Technical Analysis The scripts intentionally support `FILTRIX_MCP_URL` as an endpoint override, but they do not validate its scheme, hostna ...[truncated 2569 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Require the endpoint to use HTTPS: ```python from urllib.parse import urlparse parsed = urlparse(mcp_url) if parsed.scheme != "https": raise RuntimeError("FILTRIX_MCP_URL must use HTTPS") ``` 2. Allowlist the expected service hostname, such as `mcp.filtrix.ai`, and reject unexpected ports, embedded credentials, fragments, and malformed URLs. 3. Do not automatically attach the Filtrix production credential to arbitrary custom endpoints. If custom endpoints are a required feature: - Require an explicit command-line opt-in. - Use a separate credential variable for custom endpoints. - Display the normalized destination before transmitting user content. - Require explicit user confirmation when sending local images outside the official domain. 4. Disable redirects for authenticated MCP requests or validate every redirect target before resending. Authorization headers must never be forwarded across origins. 5. Remove the generic `MCP_API_KEY` fallback unless compatibility requires it. A service-specific credential variable reduces accidental credential reuse and unintended disclosure. 6. Document clearly that prompts and source images are transmitted to a remote service and may be subject to that service's storage and privacy policies. 7. Add automated tests confirming rejection of HTTP, loopback addresses, embedded credentials, unapproved domains, unexpected ports, and cross-origin redirects. ]]>