T09 · Insecure Skill Coding Practices
Error
- Location
assets/downloader.py:261- Finding
API Key Disclosure to API-Controlled Download Hosts
- Content
View full analysis
Vulnerability Details
File Location:
assets/downloader.py:105-126,assets/downloader.py:261-270, andassets/downloader.py:310-345
Vulnerability Type: Credential disclosure across trust boundaries
Risk Level: HighVulnerable Code
python def download_file(session, url, filepath, desc="Downloading"): """Download a file with progress display.""" try: resp = session.get(url, stream=True, timeout=120) resp.raise_for_status() total = int(resp.headers.get("content-length", 0)) downloaded = 0 with open(filepath, "wb") as f: for chunk in resp.iter_content(chunk_size=8192): if chunk: f.write(chunk) downloaded += len(chunk) if total > 0: pct = int(downloaded * 100 / total) bar = "█" * (pct // 5) + "░" * (20 - pct // 5) print(f"\r {bar} {pct}%", end="", flush=True) print() return True except requests.exceptions.RequestException as e: error(f"Download failed: {e}") return Falsepython session = requests.Session() session.headers.update({ "Content-Type": "application/json", "X-API-KEY": api_key, }) try: resp = session.post(API_URL, json={"url": url, "source": "短视频下载器-ClawHub"}, timeout=30) result = resp.json()python if aweme_type == "video": video_url = data.get("videoUrl") if not video_url: error("API did not return video URL") sys.exit(1) safe_title = sanitize_filename(title) or f"video_{platform}" filename = f"{safe_title}.mp4" filepath = os.path.join(output_dir, filename) info(f"Type: Video") step("Downloading video...") if download_file(session, video_url, filepath): downloaded_files.append(filepath) elif aweme_type == "photo": image_urls = data.get("imageUrls") or [] if not image_urls: err ...[truncated 2478 chars]- Remediation
View remediation
Remediation Suggestions
- Do not store authentication headers in a session reused for untrusted downloads.
- Attach the API key only to the parsing request:
python api_session = requests.Session() resp = api_session.post( API_URL, headers={ "Content-Type": "application/json", "X-API-KEY": api_key, }, json={"url": url, "source": "video-downloader"}, timeout=30, )- Use a separate unauthenticated session for media downloads:
python download_session = requests.Session() download_file(download_session, video_url, filepath)- Parse every returned media URL with
urllib.parse.urlsplit. - Require HTTPS and reject embedded credentials, malformed hostnames, and unexpected schemes.
- Where the service contract permits it, enforce an explicit allowlist of trusted media or CDN hosts.
- Ensure authentication headers are not forwarded through redirects to a different origin.
- Rotate potentially exposed user keys after deploying the fix.