T09 · Insecure Skill Coding Practices
Error
- Location
- SKILL.md:49
- Finding
- Unvalidated API Endpoint Override Can Expose Credentials and Enterprise Data## Vulnerability Details **File Location**: `SKILL.md`, lines 49–62 **Vulnerability Type**: Unrestricted service endpoint override with bearer-token forwarding **Risk Level**: High ### Vulnerable Code ```markdown ## Configuration - `VENN_API_KEY` (required) — your Venn API key - `VENN_API_URL` (optional) — defaults to `https://app.venn.ai/api/tooliq` ## Request Format All requests use POST with JSON. Examples below use this shorthand: ```bash # Full form (shown once): VENN_URL="${VENN_API_URL:-https://app.venn.ai/api/tooliq}" curl -s -X POST "${VENN_URL}/tools/search" \ -H "Authorization: Bearer ${VENN_API_KEY}" \ -H "Content-Type: application/json" \ -d '{"query": "..."}' ``` ``` ### Technical Analysis The documented request pattern accepts `VENN_API_URL` without validating its scheme or destination. The same request unconditionally attaches `VENN_API_KEY` as a bearer credential. If an attacker can influence the environment variable—such as through deployment configuration, a compromised environment file, or an untrusted sandbox configuration—the agent may send the API key and request body to an attacker-controlled endpoint. The request body can contain sensitive enterprise search terms, tool arguments, record contents, and workflow inputs. This behavior exceeds least privilege because the credential should only be disclosed to the trusted Venn service, not to an arbitrary endpoint selected through ambient configuration. ### Attack Path 1. An attacker gains the ability to set or alter `VENN_API_URL` in the agent's environment or configuration. 2. The attacker assigns an endpoint under their control, such as `https://attacker.example/api`. 3. The agent follows the documented request construction and invokes a Venn operation. 4. `curl` sends `Authorization: Bearer ${VENN_API_KEY}` and the JSON request body to the attacker-controlled endpoint. 5. The attacker records the bearer credential and sensitive request data. 6. Subject to the key's actua ...[truncated 866 chars]
- Remediation
- ## Remediation Suggestions 1. Remove `VENN_API_URL` configurability if custom service endpoints are not essential. 2. Otherwise, enforce an explicit allowlist containing only approved HTTPS origins, preferably exactly `https://app.venn.ai/api/tooliq`. 3. Parse and validate the URL before use: - Require the `https` scheme. - Require an approved hostname and port. - Reject embedded credentials, fragments, unexpected ports, and deceptive hostname suffixes. - Normalize and validate the path. 4. Ensure authorization headers are never forwarded to a different origin during redirects. Prefer disabling redirects unless operationally required. 5. Bind credentials to the intended service where supported by using scoped, short-lived tokens. 6. Fail closed when endpoint validation fails and avoid including tokens in diagnostic output. 7. Add automated tests covering malicious hosts, HTTP URLs, user-info URLs, subdomain confusion, alternate ports, and redirect-based credential forwarding.