T09 · Insecure Skill Coding Practices
Error
- Location
scripts/main.ts:539- Finding
Environment-Controlled API Base URLs Can Expose Bearer Credentials and User Content
- Content
View full analysis
Vulnerability Details
File Location:
scripts/main.ts:19-27,scripts/main.ts:305-311, andscripts/main.ts:539-563
Vulnerability Type: Unvalidated destination for sensitive network requests
Risk Level: HighThe application accepts API base URLs directly from environment variables without enforcing HTTPS or validating the destination hostname. It then sends provider bearer credentials, prompts, and potentially local image or video contents to the resulting endpoint.
ts // API Configuration const KIE_API_BASE = process.env.KIE_BASE_URL || "https://api.kie.ai"; const KIE_API_KEY = process.env.KIE_API_KEY; const LAOZHANG_API_BASE = process.env.LAOZHANG_BASE_URL || "https://api.laozhang.ai/v1"; const LAOZHANG_API_KEY = process.env.LAOZHANG_API_KEY; // API Source for understanding mode const UNDERSTANDING_API_BASE = process.env.KIE_UNDERSTANDING_BASE_URL || "https://api.kie.ai"; const UNDERSTANDING_API_KEY = process.env.KIE_UNDERSTANDING_API_KEY;The generation request sends the KIE credential to the environment-selected destination:
ts const response = await fetch(url, { method: "POST", headers: { "Content-Type": "application/json", "Authorization": `Bearer ${KIE_API_KEY}`, }, body: JSON.stringify(body), });The understanding request similarly selects an unvalidated base URL and sends the corresponding credential and request body:
ts // Determine API endpoint and credentials const apiBase = useLaozhang ? LAOZHANG_API_BASE : UNDERSTANDING_API_BASE; const apiKey = useLaozhang ? LAOZHANG_API_KEY : UNDERSTANDING_API_KEY; const apiName = useLaozhang ? "LaoZhang" : "KIE"; // Call API const url = `${apiBase}/v1/chat/completions`; const body = { model: model, messages: [ { role: "user", content: content, }, ], max_tokens: parseInt(values["max-tokens"] || "1000"), }; console.log(`\n📡 Sending request ...[truncated 3192 chars]- Remediation
View remediation
Remediation Suggestions
- Remove configurable API base URLs if custom endpoints are not an essential feature. Use fixed constants for the documented KIE and LaoZhang origins.
- If endpoint overrides are required, parse each value with
new URL()and reject invalid URLs. - Require the
https:scheme and reject URLs containing embedded user information. - Maintain an exact allowlist of approved origins, such as
https://api.kie.aiandhttps://api.laozhang.ai. Avoid suffix-based checks that could accept domains such asapi.kie.ai.attacker.example. - Bind each credential to its expected origin. Never attach a KIE credential to a LaoZhang origin, a custom origin, or any other unapproved destination.
- Disable automatic redirects for authenticated calls with
redirect: "error", or manually inspect every redirect and remove theAuthorizationheader unless the destination remains the exact approved origin. - Validate the final request URL immediately before every authenticated
fetch, including task creation, task polling, and understanding requests. - Fail closed with a clear error if validation fails; do not silently fall back to an untrusted endpoint.
- Document that understanding mode uploads explicitly selected local images and videos to a third-party service, allowing users to make an informed disclosure decision.
- Add automated tests covering HTTP URLs, lookalike domains, embedded credentials, malformed URLs, alternate ports, and cross-origin redirects.
- Rotate any API keys that may already have been used while untrusted endpoint environment variables were present.