T09 · Insecure Skill Coding Practices
Error
- Location
- SKILL.md:175
- Finding
- Bearer API credential can be transmitted to an attacker-controlled gateway<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 175–191 **Vulnerability Type**: Unvalidated credential destination **Risk Level**: High ### Vulnerable Code ```python GATEWAY_URL = os.environ.get("GREENHELIX_API_URL", "https://sandbox.greenhelix.net") class GreenHelixClient: """Client for the GreenHelix A2A Commerce Gateway.""" def __init__(self, api_key: str): self.api_key = api_key self.headers = { "Authorization": f"Bearer {api_key}", "Content-Type": "application/json", } def execute(self, tool: str, params: dict[str, Any]) -> dict: """Execute a single tool via the GreenHelix REST API.""" response = requests.post( f"{GATEWAY_URL}/v1", headers=self.headers, json={"tool": tool, "input": params}, timeout=30, ) ``` ### Technical Analysis The destination receiving the `Authorization` bearer credential is controlled entirely by the `GREENHELIX_API_URL` environment variable. The example does not validate the URL scheme, hostname, port, or redirect behavior before attaching the credential. Environment variables may be modified by a compromised deployment configuration, malicious wrapper, poisoned CI/CD configuration, or another process with control over how the application is launched. An attacker could set the variable to an arbitrary HTTP or HTTPS endpoint and capture the GreenHelix API key when the client performs its next operation. The client also does not explicitly disable redirects. Although common HTTP clients generally remove authorization headers during many cross-host redirects, relying on library-specific redirect behavior is insufficient protection for a payment client. ### Attack Path 1. An attacker obtains control over the application’s environment or deployment configuration. 2. The attacker sets `GREENHELIX_API_URL` to an endpoint under their control. 3. A user initializes `GreenHelixCl ...[truncated 1203 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions - Pin the gateway to an explicit set of approved HTTPS origins rather than accepting an unrestricted URL from the environment. - If endpoint configuration is required, parse it and enforce: - The `https` scheme. - An exact allowlist of GreenHelix hostnames. - Approved ports only. - No embedded user information. - No unexpected path, query, or fragment components. - Disable redirects for credential-bearing requests or revalidate every redirect destination before following it. - Use separate, narrowly scoped credentials for sandbox and production. - Restrict payment keys to only the tools required by the application. - Rotate the credential immediately if it may have been sent to an untrusted endpoint. - Keep credentials in a dedicated secret manager and prevent untrusted launch wrappers or deployment inputs from controlling security-sensitive endpoint configuration. - Add automated tests confirming that credentials are never attached to requests for unapproved origins. ]]>