T09 · Insecure Skill Coding Practices
Error
- Location
- SKILL.md:15
- Finding
- Long-Lived Authentication Token Can Be Sent to an Untrusted Configurable Endpoint## Vulnerability Details **File Location**: `SKILL.md:15-17`, `SKILL.md:39-42`, and `SKILL.md:93-96` **Vulnerability Type**: Credential exposure through insufficient endpoint validation **Risk Level**: High The skill defines a user-configurable base URL and subsequently sends the long-lived Ghostfolio token to that URL. It neither validates the destination hostname nor requires HTTPS for non-loopback destinations. ```bash # Prefer local access when available export GHOSTFOLIO_BASE_URL="http://127.0.0.1:3333" # Optional remote example: # export GHOSTFOLIO_BASE_URL="https://rpi5.gate-mintaka.ts.net:8444" ``` The anonymous exchange sends the long-lived token in a request body: ```bash AUTH_TOKEN=$(curl -fsS "$GHOSTFOLIO_BASE_URL/api/v1/auth/anonymous" \ -H 'Content-Type: application/json' \ --data "{\"accessToken\":\"$GHOSTFOLIO_TOKEN\"}" \ | jq -r '.authToken') ``` The direct authentication probe sends it as a bearer token: ```bash code=$(curl -s -o /tmp/gf_probe.json -w '%{http_code}' "$GHOSTFOLIO_BASE_URL$ep" \ -H "Authorization: Bearer $GHOSTFOLIO_TOKEN" \ -H 'Accept: application/json' \ -H "x-ghostfolio-timezone: $GHOSTFOLIO_TIMEZONE") ``` ### Technical Analysis `GHOSTFOLIO_BASE_URL` determines the server receiving both authentication requests and authenticated API calls. No hostname allowlist, URL-scheme validation, trust confirmation, or loopback-only restriction is applied before the long-lived token is transmitted. Although plaintext HTTP is appropriate for the documented IPv4 loopback address when the service is local, the same variable can contain an arbitrary non-loopback HTTP or HTTPS destination. The remote example also uses a project-specific hostname rather than clearly limiting remote access to an administrator-verified Ghostfolio instance. Consequently, an incorrectly configured or attacker-influenced environment value can direct the authentication material to a server out ...[truncated 1145 chars]
- Remediation
- ## Remediation Suggestions - Permit plaintext HTTP only when the parsed destination is an explicit loopback address such as `127.0.0.1` or `::1`. - Require HTTPS for every non-loopback destination. - Validate the destination hostname against an administrator-controlled allowlist before transmitting credentials. - Require explicit user confirmation when the endpoint differs from the expected Ghostfolio host. - Remove the project-specific remote hostname from the generic skill example or clearly mark it as a placeholder that must be replaced and independently verified. - Recommend short-lived, narrowly scoped, and revocable API credentials rather than long-lived tokens. - Avoid inheriting security-sensitive endpoint values from untrusted execution environments. - Document token rotation and immediate revocation procedures for suspected disclosure.