T09 · Insecure Skill Coding Practices
Warning
- Location
- SKILL.md:24
- Finding
- Configurable Proxy Endpoint Can Receive the Distil API Key## Vulnerability Details **File Locations**: - `SKILL.md:24-33` - `README.md:21-35` **Vulnerability Type**: Credential disclosure through an unrestricted configurable network endpoint **Risk Level**: Medium ### Vulnerable Code `SKILL.md:24-33`: ```bash 1. Get your free API key with email verification from https://distil.net (sign up or use your existing key) 2. Set the `DISTIL_API_KEY` environment variable 3. Optional: set `DISTIL_PROXY_URL` (defaults to `https://proxy.distil.net`) ## Commands ```bash # Fetch any URL as clean Markdown curl -s "${DISTIL_PROXY_URL:-https://proxy.distil.net}/https://example.com" \ -H "X-Distil-Key: $DISTIL_API_KEY" ``` `README.md:21-35`: ```bash ```bash export DISTIL_API_KEY=dk_yourkey ``` Optional: ```bash export DISTIL_PROXY_URL=https://proxy.distil.net ``` ### Verify the install ```bash curl -s "${DISTIL_PROXY_URL:-https://proxy.distil.net}/https://example.com" \ -H "X-Distil-Key: $DISTIL_API_KEY" ``` ### Technical Analysis The documented commands attach the sensitive `DISTIL_API_KEY` value to an `X-Distil-Key` HTTP header while deriving the destination from the configurable `DISTIL_PROXY_URL` environment variable. Supplying the API key to the default Distil endpoint is necessary for the declared proxy functionality. However, the instructions do not validate the override's scheme or hostname before sending the credential. Consequently, an attacker or unsafe configuration source capable of changing `DISTIL_PROXY_URL` can redirect authenticated requests to an arbitrary server. The override may also use plaintext HTTP, exposing the key and request metadata to network interception. The same pattern is used for fetching pages, searching, rendering, screenshots, raw retrieval, and cache bypass. These operations can additionally expose requested URLs and search queries to the selected proxy operator. ### Attack Path 1. An attacker influences t ...[truncated 1271 chars]
- Remediation
- ## Remediation Suggestions 1. Use the fixed trusted endpoint `https://proxy.distil.net` by default and avoid allowing an unrestricted environment variable to determine where credentials are sent. 2. If self-hosted proxies must be supported, validate `DISTIL_PROXY_URL` before attaching the API key: - Require HTTPS. - Reject embedded credentials, unexpected ports, malformed URLs, redirects to untrusted hosts, and non-HTTP schemes. - Restrict destinations to an explicit administrator-controlled hostname allowlist. 3. Separate credentials by endpoint. A self-hosted proxy should use a dedicated key rather than automatically receiving the production Distil API key. 4. Configure `curl` to fail safely and constrain redirects. Use options such as `--fail-with-body`, `--proto '=https'`, and an appropriate redirect policy. Do not forward the authentication header across redirects to an untrusted host. 5. Document that the proxy receives target URLs, search queries, and related metadata, and warn users not to submit secrets or sensitive internal URLs unless the proxy is trusted. 6. Rotate `DISTIL_API_KEY` immediately if it may have been used with an untrusted endpoint, and review account usage for unauthorized requests. 7. Update both `SKILL.md` and `README.md` so their examples and security guidance remain consistent.