T09 · Insecure Skill Coding Practices
Error
- Location
- auth.mjs:53
- Finding
- Configurable API endpoint can expose bearer tokens to an untrusted server<![CDATA[ ## Vulnerability Details **File Location**: `auth.mjs:53-60, 463-475` **Vulnerability Type**: Unvalidated credential-bearing network destination **Risk Level**: High ### Vulnerable Code ```js const API_V2_BASE_URL = process.env.ECHOSYNC_API_V2_URL ?? dotenv.ECHOSYNC_API_V2_URL ?? 'https://go.echosync.io'; ``` ```js async function requestApi(path, token, options = {}) { const baseUrl = resolveApiBaseForPath(path); const url = `${baseUrl}${path}`; printVerboseRequest(url, options); const res = await fetch(url, { ...options, headers: { authorization: `Bearer ${token}`, ...(options.headers ?? {}), }, }); const rawText = await res.text(); ``` ### Technical Analysis The destination for authenticated requests can be overridden through the inherited `ECHOSYNC_API_V2_URL` environment variable or a Skill-local `.env` file. The resulting URL is not restricted to HTTPS and is not checked against an approved hostname before the stored OAuth bearer token is attached. Consequently, a malicious or accidentally unsafe configuration can direct authenticated requests to an attacker-controlled server. This behavior is especially sensitive because the same token authorizes profile, wallet, copy-trading, and Hyperliquid trading operations. Although configurable endpoints can be useful for development, unrestricted endpoint replacement exceeds the minimum privileges required by the production Skill. Authentication credentials should only be sent to an explicitly trusted origin. ### Attack Path 1. An attacker or compromised deployment mechanism sets `ECHOSYNC_API_V2_URL` to an attacker-controlled origin, such as `https://attacker.example`. 2. The user completes EchoSync authentication, causing a bearer token to be stored locally. 3. The user or agent invokes an authenticated command such as `me`, `follows`, or `hl-order`. 4. `requestApi()` constructs the request using the attacker-controlled base URL. 5. The helper attach ...[truncated 771 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions - Pin credential-bearing production requests to `https://go.echosync.io`. - If endpoint overrides are required for development, enable them only through an explicit development mode that is disabled by default. - Parse the configured value with `new URL()` and enforce: - `https:` protocol. - An exact approved hostname. - An approved port. - No embedded username or password. - Disable automatic cross-origin redirects or verify the origin after every redirect before forwarding authorization headers. - Never attach bearer tokens to an origin that differs from the explicitly approved API origin. - Document any supported endpoint override and warn that it must never reference an untrusted service. ]]>