T09 · Insecure Skill Coding Practices
Error
- Location
SKILL.md:237- Finding
Bearer API Key Can Be Sent to an Arbitrary Configurable Host
- Content
View full analysis
dict: """Make a real API call to GreenHelix.""" start = time.monotonic() resp = self.session.post( f"{self.base_url}/v1", json={"tool": tool, "input": input_data}, ) ``` ### Technical Analysis The `AgentTestHarness` accepts an unrestricted `base_url` and stores the API key in the default headers of a persistent `requests.Session`. No validation ensures that the destination uses HTTPS or belongs to an approved GreenHelix hostname. When the harness operates in `record` or `passthrough` mode, `_live_call()` sends the bearer credential directly to the configured destination. A malicious or accidentally modified configuration can therefore redirect an authenticated request to an attacker-controlled server. Authentication is necessary for live GreenHelix integration tests, but allowing the credential to be transmitted to an arbitrary host exceeds the minimum privileges required by the declared testing functionality. The issue appears in illustrative, non-executable guide content; however, the guide explicitly pre ...[truncated 1373 chars]- Remediation
View remediation
str: parsed = urlparse(value) if ( parsed.scheme != "https" or parsed.hostname not in ALLOWED_HOSTS or parsed.username is not None or parsed.password is not None or parsed.port not in (None, 443) ): raise ValueError("Unapproved GreenHelix API endpoint") return value.rstrip("/") def _live_call(self, tool: str, input_data: dict) -> dict: endpoint = validate_base_url(self.base_url) return requests.post( f"{endpoint}/v1", headers={ "Content-Type": "application/json", "Authorization": f"Bearer {self.api_key}", }, ...[truncated 108 chars]