T09 · Insecure Skill Coding Practices
Error
- Location
scripts/whoami_profile.py:45- Finding
Unvalidated endpoint override exposes API credentials and personal profile data
- Content
View full analysis
str: # 优先使用环境变量（开发测试用），其次配置文件，最后硬编码默认值 env_endpoint = os.environ.get("WHOAMI_ENDPOINT") if env_endpoint: return env_endpoint.rstrip("/") config = _load_config() return config.get("WHOAMI_ENDPOINT", DEFAULT_ENDPOINT) ``` ```python endpoint = _get_endpoint() url = f"{endpoint}/api{path}" headers = { "Authorization": f"Bearer {api_key}", "Content-Type": "application/json", } data = None if body is not None: data = json.dumps(body).encode("utf-8") req = Request(url, data=data, headers=headers, method=method) ``` ### Technical Analysis The destination for authenticated API requests can be overridden using either the `WHOAMI_ENDPOINT` environment variable or the `WHOAMI_ENDPOINT` entry in `~/.whoamiagent`. The value is used without validating its scheme, hostname, port, or relationship to the legitimate service. Every API request includes the user's bearer credential in the `Authorization` header. Profile updates also include the complete personal profile in the request body. Consequently, control over the process environment or configuration file is sufficient to redirect both credentials and sensitive profile data to an attacker-controlled server. The network transfer itself is part of the declared remote-profile functionality. The vulnerability is that sensitive requests are not restricted to the service for which the credentials were issued. ### Attack Path 1. An attacker or compromised local process sets `WHOAMI_ENDPOINT` to an attacker-controlled URL, or inserts that value into `~/.whoamiagent`. 2. The user or AI agent invokes `get`, `info`, or `update`. 3. `_get_endpoint()` returns the attacker-controlled dest ...[truncated 989 chars]- Remediation
View remediation