T09 · Insecure Skill Coding Practices
Error
- Location
main.py:225- Finding
Unvalidated LLM Endpoint Can Exfiltrate Bearer Credentials and Research Data
- Content
View full analysis
Warning: No LLM API key is configured; using the local template." paper_summaries = "\n".join([ f"- {p['title']} ({p.get('year','')}): {p.get('abstract','No abstract')[:200]}..." for p in papers[:15] ]) headers = { "Authorization": f"Bearer {api_key}", "Content-Type": "application/json" } data = { "model": config.get("llm_model"), "messages": [{"role": "user", "content": prompt}], "temperature": 0.3 } api_base = config.get("llm_api_base") try: resp = requests.post( f"{api_base}/chat/completions", headers=headers, json=data, timeout=60 ) ``` The endpoint value originates from command-line JSON without validation: ```python config = DEFAULT_CONFIG.copy() if args.config: try: user_config = json.loads(args.config) config.update(user_config) except: pass ``` ### Technical Analysis The `llm_api_base` setting is accepted from the `--config` argument and merged directly into the runtime configuration. When LLM writing is enabled, the application sends the configured API key in an `Authorization: Bearer` header to that endpoint. There is no hostname allowlist, HTTPS enforcement, URL-scheme validation, or binding between an API key and its intended provider. An attacker who can influence the command invocation or supplied configuration can therefore redirect a credential-bearing request to an arbitrary server. The request body also contains the user-supplied research topic and externally retrieved paper titles and abstracts. Consequently, exploitation can disclose both the credential and ...[truncated 1308 chars]- Remediation
View remediation