T09 · Insecure Skill Coding Practices
Warning
- Location
job_search_apply.py:15- Finding
API Credential and Applicant Data Sent to an Inconsistently Documented Domain
- Content
View full analysis
dict: r = requests.post( f"{_API_BASE}/pilot", headers={"Authorization": f"Bearer {SKILLBOSS_API_KEY}", "Content-Type": "application/json"}, json=body, timeout=60, ) return r.json() ``` ### Technical Analysis The executable sends `SKILLBOSS_API_KEY` as a bearer credential to `api.heybossai.com`. This destination is inconsistent with the SkillBoss service identity presented elsewhere in the project. In particular, the integration examples in `platform_integration.md` use `api.skillboss.com`. The request body also contains AI prompts generated from job descriptions and applicant attributes. Depending on the invoked function, those prompts include the applicant's name, years of experience, LinkedIn URL, and cover-letter template. The Skill does not explain the relationship between the two domains, allow the user to approve or configure the endpoint, validate the expected service identity beyond normal TLS handling, or disclose the exact applicant fields transmitted. It also calls `r.json()` without first calling `raise_for_status()`, which can obscure authentication, redirection, or server-side failures. The network request is related to the declared AI functionality, but transmitting the bearer credential to an inconsistently documented domain exceeds what users can reasonably verify from the supplied documentation. ### Attack Path 1. A user obtains a SkillBoss API key and places it in `SKILLBOSS_API_KEY`. 2. The user invokes compatibility analysis or cover-letter generation. 3. `_pilot()` constructs an HTTPS request to `https://api.heybossai.com/v1/pilot`. 4. The request se ...[truncated 855 chars]- Remediation
View remediation