T09 · Insecure Skill Coding Practices
Warning
- Location
solpaw-skill.ts:83- Finding
API Credentials Can Be Transmitted to an Arbitrary Configured Endpoint
- Content
View full analysis
( method: string, path: string, body?: Record, headers?: Record ): Promise { const url = `${this.config.apiEndpoint}${path}`; const response = await fetch(url, { method, headers: { "Content-Type": "application/json", Authorization: `Bearer ${this.config.apiKey}`, ...headers, }, body: body ? JSON.stringify(body) : undefined, signal: AbortSignal.timeout(120000), }); ``` ### Technical Analysis The constructor accepts any nonempty `apiEndpoint` and performs no scheme, origin, or host validation. The common request function then attaches the SolPaw API key as a Bearer credential to every request made against that endpoint. Consequently, the API key can be disclosed if the endpoint is changed to an attacker-controlled server through a malicious configuration, configuration injection, deployment mistake, or compromised agent configuration. The code also does not require HTTPS, so a configured plaintext HTTP endpoint could expose credentials and request bodies to network interception. The outbound request body may additionally contain the creator wallet, payment transaction signature, CSRF token, token metadata, social links, and fee parameters. Most of those fields are necessary for the hosted launch service, but they must only be s ...[truncated 1212 chars]- Remediation
View remediation