T09 · Insecure Skill Coding Practices
Error
- Location
- scripts/whoami_profile.py:45
- Finding
- Unvalidated endpoint override exposes API credentials and personal profile data<![CDATA[ ## Vulnerability Details **File Location**: `scripts/whoami_profile.py`, lines 45-51 and 109-122 **Vulnerability Type**: Unvalidated network destination for authenticated requests **Risk Level**: High ### Vulnerable Code ```python def _get_endpoint() -> str: # 优先使用环境变量（开发测试用），其次配置文件，最后硬编码默认值 env_endpoint = os.environ.get("WHOAMI_ENDPOINT") if env_endpoint: return env_endpoint.rstrip("/") config = _load_config() return config.get("WHOAMI_ENDPOINT", DEFAULT_ENDPOINT) ``` ```python endpoint = _get_endpoint() url = f"{endpoint}/api{path}" headers = { "Authorization": f"Bearer {api_key}", "Content-Type": "application/json", } data = None if body is not None: data = json.dumps(body).encode("utf-8") req = Request(url, data=data, headers=headers, method=method) ``` ### Technical Analysis The destination for authenticated API requests can be overridden using either the `WHOAMI_ENDPOINT` environment variable or the `WHOAMI_ENDPOINT` entry in `~/.whoamiagent`. The value is used without validating its scheme, hostname, port, or relationship to the legitimate service. Every API request includes the user's bearer credential in the `Authorization` header. Profile updates also include the complete personal profile in the request body. Consequently, control over the process environment or configuration file is sufficient to redirect both credentials and sensitive profile data to an attacker-controlled server. The network transfer itself is part of the declared remote-profile functionality. The vulnerability is that sensitive requests are not restricted to the service for which the credentials were issued. ### Attack Path 1. An attacker or compromised local process sets `WHOAMI_ENDPOINT` to an attacker-controlled URL, or inserts that value into `~/.whoamiagent`. 2. The user or AI agent invokes `get`, `info`, or `update`. 3. `_get_endpoint()` returns the attacker-controlled dest ...[truncated 989 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions - Pin production API traffic to the exact expected origin, such as `https://whoamiagent.com`. - Require HTTPS and reject credentials configured with HTTP or other schemes. - Parse override URLs and validate the scheme, hostname, and permitted port before use. - Disable endpoint overrides in production builds. If development overrides are necessary, require an explicit development mode and use separate test credentials. - Prevent bearer credentials from being forwarded across cross-origin redirects. - Separate endpoint configuration from the credential file so compromise of one setting does not silently redirect the credential stored beside it. - Display the validated destination and require explicit user approval before sending sensitive information to a non-production endpoint. ]]>