T09 · Insecure Skill Coding Practices
Error
- Location
SKILL.md:49- Finding
Unvalidated API Endpoint Override Can Expose Credentials and Enterprise Data
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 49–62
Vulnerability Type: Unrestricted service endpoint override with bearer-token forwarding
Risk Level: HighVulnerable Code
markdown ## Configuration - `VENN_API_KEY` (required) — your Venn API key - `VENN_API_URL` (optional) — defaults to `https://app.venn.ai/api/tooliq` ## Request Format All requests use POST with JSON. Examples below use this shorthand: ```bash # Full form (shown once): VENN_URL="${VENN_API_URL:-https://app.venn.ai/api/tooliq}" curl -s -X POST "${VENN_URL}/tools/search" \ -H "Authorization: Bearer ${VENN_API_KEY}" \ -H "Content-Type: application/json" \ -d '{"query": "..."}'text ### Technical Analysis The documented request pattern accepts `VENN_API_URL` without validating its scheme or destination. The same request unconditionally attaches `VENN_API_KEY` as a bearer credential. If an attacker can influence the environment variable—such as through deployment configuration, a compromised environment file, or an untrusted sandbox configuration—the agent may send the API key and request body to an attacker-controlled endpoint. The request body can contain sensitive enterprise search terms, tool arguments, record contents, and workflow inputs. This behavior exceeds least privilege because the credential should only be disclosed to the trusted Venn service, not to an arbitrary endpoint selected through ambient configuration. ### Attack Path 1. An attacker gains the ability to set or alter `VENN_API_URL` in the agent's environment or configuration. 2. The attacker assigns an endpoint under their control, such as `https://attacker.example/api`. 3. The agent follows the documented request construction and invokes a Venn operation. 4. `curl` sends `Authorization: Bearer ${VENN_API_KEY}` and the JSON request body to the attacker-controlled endpoint. 5. The attacker records the bearer credential and sensitive request data. 6. Subject to the key's actua ...[truncated 866 chars]- Remediation
View remediation
Remediation Suggestions
- Remove
VENN_API_URLconfigurability if custom service endpoints are not essential. - Otherwise, enforce an explicit allowlist containing only approved HTTPS origins, preferably exactly
https://app.venn.ai/api/tooliq. - Parse and validate the URL before use:
- Require the
httpsscheme. - Require an approved hostname and port.
- Reject embedded credentials, fragments, unexpected ports, and deceptive hostname suffixes.
- Normalize and validate the path.
- Require the
- Ensure authorization headers are never forwarded to a different origin during redirects. Prefer disabling redirects unless operationally required.
- Bind credentials to the intended service where supported by using scoped, short-lived tokens.
- Fail closed when endpoint validation fails and avoid including tokens in diagnostic output.
- Add automated tests covering malicious hosts, HTTP URLs, user-info URLs, subdomain confusion, alternate ports, and redirect-based credential forwarding.
- Remove