T09 · Insecure Skill Coding Practices
- Location
SKILL.md:52- Finding
Bearer Credential Forwarding to an Unrestricted Configurable API Endpoint
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md:25-35,SKILL.md:52-58, andSKILL.md:465-469; equivalent behavior is documented inREADME.md:69-81,README.md:95-97, andREADME.md:118-123
Vulnerability Type: Unrestricted credential destination
Risk Level: MediumVulnerable Code
json { "skills": { "entries": { "praesidia": { "apiKey": "pk_live_your_key_here", "env": { "PRAESIDIA_API_URL": "https://api.praesidia.ai" } } } } }javascript web_fetch({ url: "${PRAESIDIA_API_URL}/agents/chatbot-v2/agent-card", headers: { "Authorization": "Bearer ${PRAESIDIA_API_KEY}", "Accept": "application/json" } })markdown - `PRAESIDIA_API_URL` (optional) - Defaults to `https://api.praesidia.ai` - Production: `https://api.praesidia.ai` - Local dev: `http://localhost:3000` - Custom: Your deployment URLTechnical Analysis
Authenticated API calls construct their destination from the configurable
PRAESIDIA_API_URLand automatically attachPRAESIDIA_API_KEYas a bearer credential. The documentation permits an arbitrary custom deployment URL but does not require an approved hostname, HTTPS, certificate validation policy, or explicit confirmation before sending the credential.Configurable API endpoints are legitimate for self-hosted deployments, but forwarding a production credential to any configured destination violates credential-origin isolation and least-privilege principles. A malicious, compromised, or accidentally incorrect configuration can cause the Skill to disclose the bearer credential to an attacker-controlled server. Permitting non-TLS local-development URLs also becomes unsafe if such a URL is configured for a non-loopback destination.
The same pattern affects authenticated agent discovery and guardrail endpoints elsewhere in both documents.
Attack Path
...[truncated 1421 chars]
- Remediation
View remediation
Remediation Suggestions
- Allowlist
https://api.praesidia.aias the default production credential destination. - Require explicit user approval before sending credentials to a custom host.
- Bind credentials to an expected scheme, hostname, and port rather than attaching the same key to every configured URL.
- Require HTTPS for all remote destinations. Permit HTTP only for explicit loopback addresses such as
127.0.0.1,localhost, or::1. - Use separate, restricted development credentials for self-hosted or local environments; never reuse production keys.
- Reject URLs containing user information, redirects to unapproved hosts, unexpected schemes, or non-loopback plaintext destinations.
- Do not forward authorization headers across redirects unless the redirect target is independently trusted.
- Scope API keys to the minimum required operations and organizations, and support expiration and rapid revocation.
- Warn users before transmitting PII, healthcare information, credentials, or other sensitive content to the validation endpoint.
- Allowlist