T09 · Insecure Skill Coding Practices
Error
- Location
- scripts/model_adapters.py:303
- Finding
- Custom provider endpoints can expose API credentials and source-document content<![CDATA[ ## Vulnerability Details **File Location**: `scripts/model_adapters.py`, lines 303–315 and 733–766 **Vulnerability Type**: Unrestricted provider endpoint and insecure transport configuration **Risk Level**: High ### Complete Code Snippet ```python base = p.get("base_url") or _DEFAULT_BASES.get(p.get("name", ""), "") info = ProviderInfo( name=p.get("name") or dialect, dialect=dialect, model=p.get("model", ""), base_url=base, api_key_env=p.get("api_key_env", ""), alt_models=list(p.get("alt_models", []) or []), headers=dict(p.get("headers", {}) or {}), supports_system=p.get("supports_system"), supports_temperature=p.get("supports_temperature"), supports_seed=p.get("supports_seed"), supports_json_mode=p.get("supports_json_mode"), max_tokens_field=p.get("max_tokens_field"), context=int(p.get("context", 0) or 0), weight=int(p.get("weight", 60) or 60), notes=p.get("notes", ""), ) ``` ```python def _b_openai(p, model, prompt, system, max_tokens, json_mode, seed, caps): field_name = caps.get("max_tokens_field") or p.max_tokens_field or "max_tokens" msgs = [] if system and caps.get("supports_system", p.supports_system) is not False: msgs.append({"role": "system", "content": system}) user = prompt else: user = (system + "\n\n" + prompt) if system else prompt msgs.append({"role": "user", "content": user}) body: Dict[str, Any] = {"model": model, "messages": msgs, field_name: max_tokens} if caps.get("supports_stream_field", True) is not False: body["stream"] = False if caps.get("supports_temperature", p.supports_temperature) is not False: body["temperature"] = 0 if caps.get("supports_top_p", True) is not False: body["top_p"] = 1 if seed is not None and caps.get("supports_seed", p.supports_seed) is not False: body["seed"] = seed if json_mode and caps.get("supports_json_mode", p.supports_json_mode) i ...[truncated 3373 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Require HTTPS for all non-loopback model endpoints. 2. Permit plain HTTP only for verified loopback destinations such as `127.0.0.1`, `[::1]`, or a deliberately approved local Unix-socket bridge. 3. Maintain an allowlist of expected origins for built-in providers. 4. Require an explicit, prominently logged confirmation before using a custom provider origin. 5. Validate URLs and reject user-info components, fragments, unsupported schemes, malformed hosts, and unexpected ports. 6. Disable redirects for authenticated requests, or revalidate every redirect destination and strip authorization headers whenever the origin changes. 7. Block link-local, metadata-service, and private-network destinations by default for non-local provider configurations. 8. Restrict `api_key_env` to recognized variables unless the operator explicitly approves a custom variable. 9. Prevent arbitrary custom headers from overriding security-sensitive headers such as `Authorization`, `Host`, and provider authentication headers. 10. Before the first request, display the destination origin and a clear warning that source-document content will leave the local machine. 11. Add automated tests covering HTTP rejection, cross-origin redirects, authorization-header stripping, and malicious custom provider configurations. ]]>