T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/yufluent_api.py:211- Finding
Arbitrary API endpoint configuration can expose bearer credentials and review data over plaintext HTTP
- Content
View full analysis
str: base = (base_url or "").strip().rstrip("/") if not base: base = "http://localhost:8080/v1" if base.endswith("/v1"): return base return f"{base}/v1" ``` ```python def _auth_headers(api_key: str) -> dict[str, str]: return { "Authorization": f"Bearer {api_key}", "Accept": "application/json", } ``` ```python root = base_url or os.getenv("TOKENAPI_BASE_URL", "") url = skill_run_url(root, skill_id) try: resp = _post_json(url, api_key=key, body=payload, timeout=timeout) except requests.RequestException as exc: raise YufluentApiError(f"Request failed: {exc}") from exc ``` ### Technical Analysis The client obtains its network destination from the optional `base_url` argument or the `TOKENAPI_BASE_URL` environment variable. The URL normalization logic accepts arbitrary schemes and hosts without enforcing TLS, rejecting embedded credentials, or restricting the destination to a trusted Yufluent service. The request includes two sensitive data classes: 1. `TOKENAPI_KEY`, transmitted in the `Authorization: Bearer` header. 2. The complete analysis payload, including the review text read from an explicitly supplied file or command-line value, product information, language, and platform. Sending these values to a cloud service is necessary for the Skill's declared cloud-based review-analysis functionality. The security defect is that the same sensitive values can be sent to any configured endpoint, including a remote endpoint using plaintext HTTP. The default loopback HTTP endpoint is not itself an Internet disclosure, but the implementation does not limit ...[truncated 2322 chars]- Remediation
View remediation
s ...[truncated 761 chars]