T09 · Insecure Skill Coding Practices
- Location
SKILL.md:165- Finding
Bearer Credential and Sensitive Data Exposure Through an Unrestricted API Endpoint
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md:165-184
Vulnerability Type: Unrestricted remote endpoint configuration with credential forwarding
Risk Level: HighVulnerable Code
python GATEWAY_URL = os.environ.get("GREENHELIX_API_URL", "https://sandbox.greenhelix.net") class InsuranceClient: """Client for agent insurance operations on GreenHelix.""" def __init__(self, api_key: str): self.api_key = api_key self.headers = { "Authorization": f"Bearer {api_key}", "Content-Type": "application/json", } def execute(self, tool: str, params: dict[str, Any]) -> dict: """Execute a single tool via the GreenHelix REST API.""" response = requests.post( f"{GATEWAY_URL}/v1", headers=self.headers, json={"tool": tool, "input": params}, timeout=30, ) response.raise_for_status() return response.json()Technical Analysis
The destination for every API request can be overridden through
GREENHELIX_API_URL. The client does not validate the URL scheme, hostname, port, or resolved network address before attaching the bearer token and submitting the request.Consequently, anyone who can influence this environment variable can redirect requests to an unintended server. Every redirected request includes the
Authorization: Bearerheader and the complete tool input. Subsequent examples use this client for agent identities, wallet identifiers, transaction amounts, policy details, trust information, spending authorization, and insurance claim evidence.This network behavior is relevant to the declared insurance workflow, but allowing credentials to be sent to an arbitrary endpoint exceeds the minimum privilege necessary. The guide also describes the sandbox as requiring no credentials while supplying a bearer-token client, creating ambiguity that co ...[truncated 1393 chars]
- Remediation
View remediation
Remediation Suggestions
- Allowlist the exact approved API hosts, such as the documented GreenHelix sandbox and production hostnames.
- Require HTTPS and reject HTTP, non-web schemes, embedded credentials, unexpected ports, and malformed URLs.
- Resolve and reject loopback, private, link-local, multicast, and other non-public destination addresses where they are not explicitly required.
- Do not attach bearer credentials when a custom endpoint is selected. Use separate credentials with minimal scopes for each environment.
- Prefer explicit, trusted configuration files over inherited environment variables for security-sensitive endpoint selection.
- Document secure secret injection and rotation instead of encouraging credentials to be placed directly in source code.
- Use short-lived, operation-scoped tokens and revoke them immediately after suspected disclosure.
- Add tests confirming that unapproved destinations cannot receive authenticated requests.
- Reconcile the guide's statement that no credentials are required with the bearer-token examples and clearly distinguish sandbox examples from authenticated production use.