T09 · Insecure Skill Coding Practices
Error
- Location
- SKILL.md:18
- Finding
- Configurable API Base URL Can Expose the Karma API Key## Vulnerability Details **File Location**: `SKILL.md`, lines 18–20 and 29–33 **Vulnerability Type**: Untrusted endpoint configuration leading to credential disclosure **Risk Level**: High ### Vulnerable Code ```bash BASE_URL="${KARMA_API_URL:-https://gapapi.karmahq.xyz}" API_KEY="${KARMA_API_KEY}" INVOCATION_ID=$(uuidgen) ``` ```bash curl -s "${BASE_URL}/v2/agent/info" \ -H "x-api-key: ${API_KEY}" \ -H "X-Source: skill:project-manager" -H "X-Invocation-Id: $INVOCATION_ID" -H "X-Skill-Version: 2.0.0" ``` The same configurable `BASE_URL` is also used by other authenticated API requests documented in the skill. ### Technical Analysis The skill accepts `KARMA_API_URL` from the process environment without validating its scheme or destination hostname. It then attaches the sensitive `KARMA_API_KEY` value as an `x-api-key` header to requests sent to that endpoint. An attacker capable of controlling or poisoning the skill's environment can set `KARMA_API_URL` to an attacker-operated server. When the skill verifies the API key or performs another authenticated request, `curl` sends the key to that server. The configuration also does not require HTTPS, so an `http://` override could expose the credential in plaintext to a network-positioned attacker. The documented setup verification is sufficient to trigger disclosure; no project mutation needs to occur. ### Attack Path 1. An attacker gains the ability to influence the environment used to launch the agent or skill. 2. The attacker sets `KARMA_API_URL` to an attacker-controlled URL, such as `https://attacker.example`. 3. A legitimate user invokes the skill while `KARMA_API_KEY` is configured. 4. Following the setup instructions, the agent requests `${BASE_URL}/v2/agent/info`. 5. The request includes `x-api-key: ${API_KEY}` and sends the Karma API key to the attacker's server. 6. The attacker records the credential and reuses it against the legitimate Karma API. 7. Depending on the key's assigned permission ...[truncated 824 chars]
- Remediation
- ## Remediation Suggestions 1. Pin authenticated requests to the official API origin: ```bash BASE_URL="https://gapapi.karmahq.xyz" ``` 2. If endpoint overrides are operationally necessary, validate the URL before making any request: - Require the `https` scheme. - Compare the parsed hostname against an explicit allowlist. - Reject embedded credentials, unexpected ports, IP literals, and malformed URLs. - Do not rely on substring or prefix comparisons for hostname validation. 3. Require explicit user approval before sending credentials to any non-default endpoint. 4. Harden `curl` transport behavior: ```bash curl --proto '=https' --proto-redir '=https' ... ``` Avoid following redirects for authenticated requests. If redirects are required, ensure authentication headers cannot be forwarded to another origin. 5. Separate endpoint selection from credential attachment. Add `x-api-key` only after the destination has passed validation. 6. Use a narrowly scoped API key with the minimum permissions required by the requested operation, and rotate any key that may have been used while an untrusted `KARMA_API_URL` was configured.