T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:235- Finding
Bearer Credential Can Be Sent to a Caller-Controlled API Endpoint
- Content
View full analysis
list of handlers self._handlers: Dict[str, List[EventHandler]] = defaultdict(list) self._dead_letter_handler: Optional[EventHandler] = None # Processing state self._cursors: Dict[str, str] = {} self._processed_ids: Set[str] = set() self._semaphore = asyncio.Semaphore(max_concurrent_handlers) self._running = False self._session: Optional[aiohttp.ClientSession] = None self._tasks: List[asyncio.Task] = [] async def start(self) -> None: """Start the event bus. Polls for events and dispatches to handlers.""" self._running = True self._session = aiohttp.ClientSession( headers={ "Content-Type": "application/json", "Authorization": f"Bearer {self.api_key}", } ) ``` Requests are subsequently sent using the configurable value: ```python async with self._session.post( f"{self.base_url}/v1", json={ "tool": "publish_event", "input": { "agent_id": self.agent_id, "event_type": event.event_type, "payload": json.dumps(event.to_dict()), }, }, ) as resp: ``` ### Technical Analysis The class accepts `base_url` from its caller without validating its scheme, hostname, port, or origin. It then configures a reusable HTTP session whose default headers include the GreenHelix bearer credential. Every request made through this session therefore carries the credential to ...[truncated 1821 chars]- Remediation
View remediation