T09 · Insecure Skill Coding Practices
Error
- Location
scripts/safe_lib.ts:76- Finding
<![CDATA[Sensitive API Credentials and Safe Signatures Can Be Transmitted to Arbitrary Endpoints]]>
- Content
View full analysis
', 'Safe tx-service chain slug (e.g. base, base-sepolia, mainnet)') .option('--tx-service-url ', 'Override tx-service base URL') .option('--rpc-url ', 'RPC URL (required for signing/executing)', process.env.RPC_URL) .option('--api-key ', 'Safe Transaction Service API key', process.env.SAFE_TX_SERVICE_API_KEY) .option('--debug', 'Verbose logging'); } ``` ```ts // scripts/safe_lib.ts:84-104 export function resolveTxServiceUrl(opts: CommonOptions): string { if (opts.txServiceUrl) return opts.txServiceUrl.replace(/\/$/, ''); if (!opts.chain) throw new Error('Missing --chain or --tx-service-url'); const slug = opts.chain.toLowerCase(); const shortName = CHAIN_SHORT_NAMES[slug]; if (!shortName) { throw new Error( `Unknown chain slug "${opts.chain}" for Safe Transaction Service. ` + `Known: ${Object.keys(CHAIN_SHORT_NAMES).join(', ')}` ); } // FIX SM-001: Use api.safe.global gateway with /api suffix // The per-chain subdomains (safe-transaction-{slug}.safe.global) are deprecated. // The unified gateway at api.safe.global is the current standard. return `https://api.safe.global/tx-service/${shortName}/api`; } ``` ```ts // scripts/approve-tx.ts:47-57 // Sign the tx hash const sig = await safeSdk.signHash(opts.safeTxHash!); const apiKitConfig: { chainId: bigint; txServiceUrl: string; apiKey?: string } = { chainId, txServiceUrl }; if (opts.apiKey) apiKitConfig.apiKey = opts.apiKey; const apiKit = new SafeApiKit(apiKitConfig); await apiKit.confirmTransact ...[truncated 3365 chars]- Remediation
View remediation