T09 · Insecure Skill Coding Practices
Error
- Location
- SKILL.md:44
- Finding
- Configurable API Endpoint Can Exfiltrate the X2C API Key<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 44–55 **Vulnerability Type**: Unvalidated destination for authenticated API requests **Risk Level**: High ### Vulnerable Code ```markdown ### API Endpoint All requests go to the X2C Open API. The base URL is configured via `X2C_API_BASE_URL` env var or defaults to the production endpoint. Headers: - `Content-Type: application/json` - `X-API-Key: <your_x2c_api_key>` ### Get Categories ```bash curl -m 60 -X POST "$X2C_API_BASE_URL" \ -H "Content-Type: application/json" \ -H "X-API-Key: $X2C_API_KEY" \ -d '{"action": "distribution/categories", "lang": "zh-CN"}' ``` ``` The same pattern is repeated for the distribution and wallet API operations at lines 62–65, 89–92, 112–115, 124–127, 139–142, 150–153, 160–163, 170–173, 180–183, and 191–194. ### Technical Analysis The Skill obtains the destination URL directly from the configurable `X2C_API_BASE_URL` environment variable and attaches the sensitive `X2C_API_KEY` header to requests sent to that destination. No hostname, scheme, port, or origin validation is specified. Although the documentation claims that the variable defaults to a production endpoint, the reviewed project does not define a concrete default URL or enforce an approved origin. Consequently, an attacker who can influence the Agent's environment or Skill configuration can redirect authenticated requests to an attacker-controlled server. This is a credential-exfiltration flaw caused by combining an untrusted or insufficiently constrained endpoint with a sensitive authentication header. ### Attack Path 1. An attacker gains the ability to influence environment variables or the OpenClaw Skill configuration. 2. The attacker sets `X2C_API_BASE_URL` to an HTTPS endpoint under their control. 3. A user asks the Agent to perform a documented distribution or wallet operation. 4. The Agent follows the Skill instructions and executes `curl` against the attacker-controlled URL. ...[truncated 1019 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. **Pin the official API origin** - Define the exact production HTTPS endpoint in the Skill. - Do not allow an arbitrary environment variable to determine where authentication credentials are sent. 2. **Apply a strict origin allowlist** - If endpoint configuration is required for staging or regional deployments, parse the URL and verify its normalized scheme, hostname, and port against a fixed allowlist. - Permit HTTPS only. - Reject user information, fragments, unexpected ports, IP literals, and deceptive subdomains. 3. **Fail closed** - Abort the operation if `X2C_API_BASE_URL` is missing, malformed, or not explicitly approved. - Do not silently send the key to an unknown destination. 4. **Protect credentials across redirects** - Do not enable unrestricted redirect following. - If redirects must be supported, verify each redirect target against the same origin allowlist before forwarding authentication headers. 5. **Reduce credential privileges** - Use short-lived, narrowly scoped credentials. - Separate content-publication permissions from wallet and withdrawal permissions. - Avoid using one API key for both low-risk queries and irreversible financial operations. 6. **Require confirmation for financial mutations** - Require explicit user confirmation immediately before claims, swaps, and withdrawals. - Display the amount, asset, destination address, and approved API origin before execution. 7. **Add operational safeguards** - Redact API keys from logs and error output. - Rotate any key that may have been used while the endpoint configuration was untrusted. - Add tests confirming that credentials cannot be sent to non-allowlisted hosts. ]]>