T09 · Insecure Skill Coding Practices
Error
- Location
- scripts/paypol-discover.sh:21
- Finding
- API Credentials and Financial Instructions Can Be Sent to an Untrusted or Plaintext Endpoint<![CDATA[ ## Vulnerability Details **File Location**: `scripts/paypol-discover.sh:21-27`; `scripts/paypol-hire.sh:24-27,88-94`; `SKILL.md:28-33`; `references/api-reference.md:5-10` **Vulnerability Type**: Unrestricted destination for sensitive network transmissions **Risk Level**: High ### Vulnerable Code From `scripts/paypol-discover.sh`: ```bash API_BASE="${PAYPOL_AGENT_API:-https://paypol.xyz}" API_KEY="${PAYPOL_API_KEY:?Error: PAYPOL_API_KEY environment variable is required}" CATEGORY="${1:-}" # ── Fetch agents ────────────────────────────────────────────── RESPONSE=$(curl -s --max-time 30 \ -H "X-API-Key: ${API_KEY}" \ "${API_BASE}/marketplace/agents") ``` From `scripts/paypol-hire.sh`: ```bash API_BASE="${PAYPOL_AGENT_API:-https://paypol.xyz}" API_KEY="${PAYPOL_API_KEY:?Error: PAYPOL_API_KEY environment variable is required}" WALLET="${PAYPOL_WALLET:-openclaw-agent}" TIMEOUT="${PAYPOL_TIMEOUT:-120}" ``` ```bash RESPONSE=$(curl -s --max-time "$TIMEOUT" \ -X POST "${API_BASE}/agents/${AGENT_ID}/execute" \ -H "Content-Type: application/json" \ -H "X-API-Key: ${API_KEY}" \ -d "$(jq -n --arg prompt "$PROMPT" --arg wallet "$WALLET" \ '{prompt: $prompt, callerWallet: $wallet}')") ``` The API reference also explicitly permits configuration through an environment variable and documents a plaintext development endpoint: ```text Production: https://paypol.xyz Development: http://localhost:3000 ``` ```text Configure via `PAYPOL_AGENT_API` environment variable. ``` ### Technical Analysis The scripts accept `PAYPOL_AGENT_API` without validating its scheme, hostname, port, or trust level. They subsequently attach the PayPol API key to requests sent to that destination. The hiring script also transmits the user-controlled task prompt and caller wallet identifier. Endpoint configurability can be legitimate for development, but unrestricted endpoint selection is broader than the minimum privilege needed for production use. An attacker who can i ...[truncated 2244 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Default to `https://paypol.xyz` and reject custom production destinations unless they appear in an explicit administrator-controlled allowlist. 2. Parse the configured URL and validate its scheme and hostname before invoking `curl`. 3. Require HTTPS for all non-loopback endpoints. If local development is necessary, permit plaintext HTTP only when the parsed hostname is exactly a loopback address such as `localhost`, `127.0.0.1`, or `::1`. 4. Reject URLs containing embedded credentials, unexpected ports, fragments, or unsupported schemes. 5. Harden production requests with options such as: ```bash curl --fail --show-error --silent \ --proto '=https' \ --tlsv1.2 \ --max-time 30 \ -H "X-API-Key: ${API_KEY}" \ "https://paypol.xyz/marketplace/agents" ``` 6. Avoid following redirects for authenticated requests. If redirects are required, validate every destination and ensure credentials cannot be forwarded across origins. 7. Separate development and production configuration so enabling a development endpoint requires an explicit opt-in rather than an inherited environment variable. 8. Scope API keys to the minimum required agents and operations, apply spending limits, and rotate any key suspected of exposure. 9. Clearly warn users that task prompts are transmitted to the remote service and may contain sensitive financial information. 10. Require explicit user confirmation before remote agents perform irreversible or high-impact financial operations. ]]>