T09 · Insecure Skill Coding Practices
Warning
- Location
- SKILL.md:9
- Finding
- Configurable API Origin Can Disclose Bearer Token and Reminder Data## Vulnerability Details **File Location**: `SKILL.md`, lines 9-22 **Vulnerability Type**: Unrestricted credential-bearing outbound requests **Risk Level**: Medium ### Vulnerable Code ```yaml requires: env: - DONOTIFY_API_TOKEN - DONOTIFY_URL metadata: {"openclaw":{"requires":{"env":["DONOTIFY_API_TOKEN","DONOTIFY_URL"]},"primaryEnv":"DONOTIFY_API_TOKEN"}} --- # DoNotify Skill You can send immediate voice call reminders or schedule future calls through the DoNotify API. ## Authentication All requests require: - Header: `Authorization: Bearer $DONOTIFY_API_TOKEN` - Header: `Accept: application/json` - Base URL: `$DONOTIFY_URL` (default: `https://donotifys.com`) ``` ### Technical Analysis The Skill directs the Agent to attach `DONOTIFY_API_TOKEN` as a bearer token to requests whose origin is controlled by the `DONOTIFY_URL` environment variable. The instructions do not require validation that the configured URL uses HTTPS or belongs to the expected `donotifys.com` origin. They also do not prohibit cross-origin redirects while retaining the authorization header. If an attacker can influence the environment configuration, or if an operator enters an untrusted URL, subsequent usage checks, immediate-call requests, and scheduled-reminder requests can be sent to an attacker-controlled server. Those requests can expose both the bearer token and user-supplied reminder titles or descriptions. The package contains no executable implementation that independently enforces the documented default URL, so the statement that `https://donotifys.com` is the default does not mitigate unsafe values supplied through `DONOTIFY_URL`. ### Attack Path 1. An attacker, compromised deployment process, or unsafe configuration sets `DONOTIFY_URL` to an attacker-controlled HTTP or HTTPS endpoint. 2. The user asks the Agent to check usage, place an immediate voice call, or schedule a reminder. 3. Following the Skill ins ...[truncated 1347 chars]
- Remediation
- ## Remediation Suggestions - Remove `DONOTIFY_URL` as a user-configurable value if alternate API origins are not operationally required, and use the fixed origin `https://donotifys.com`. - If configurability is required, parse and validate the URL before sending any request: - Require the `https` scheme. - Allowlist the exact expected hostname or a narrowly defined set of trusted hosts. - Reject embedded credentials, fragments, unexpected ports, IP-literal destinations, and deceptive hostname suffixes. - Resolve and reject loopback, link-local, private, and other internal network destinations where appropriate. - Disable automatic redirects for authenticated requests, or validate every redirect target and strip the `Authorization` header whenever the origin changes. - Construct authentication headers only after destination validation; do not expose the token in logs, error messages, or response summaries. - Document that reminder titles and descriptions are transmitted to an external service and minimize sensitive content. - Use a narrowly scoped, revocable API token and rotate it immediately if an untrusted API URL may have received requests. - Add tests confirming that insecure schemes, unapproved hosts, cross-origin redirects, and deceptive hostnames are rejected before credentials or reminder data are transmitted.