T09 · Insecure Skill Coding Practices
Error
- Location
tradejournal.py:100- Finding
Bearer token disclosure through an unrestricted API base URL
- Content
View full analysis
Dict: """Make authenticated request to Simmer API.""" if not SIMMER_API_KEY: raise ValueError("SIMMER_API_KEY environment variable not set") url = f"{SIMMER_API_URL}{endpoint}" if params: # Filter None values and URL-encode parameters filtered = {k: v for k, v in params.items() if v is not None} url = f"{url}?{urlencode(filtered)}" headers = { "Authorization": f"Bearer {SIMMER_API_KEY}", "Content-Type": "application/json", } req = Request(url, headers=headers, method=method) try: with urlopen(req, timeout=REQUEST_TIMEOUT_SECONDS) as response: return json.loads(response.read().decode("utf-8")) ``` ### Technical Analysis The documented API destination is `https://api.simmer.markets`, but the implementation permits `SIMMER_API_URL` to replace that destination without validating its scheme or hostname. The same function unconditionally attaches `SIMMER_API_KEY` as a bearer token. Consequently, a process launcher, compromised configuration layer, wrapper script, CI job, or agent environment capable of setting `SIMMER_API_URL` can direct the credential to an arbitrary server. Plain HTTP is also accepted, so the token could be exposed to network observers. Supporting a configurable endpoint is not required by the functionality declared in `SKILL.md`, which identifies one fixed service. This behavior therefore exceeds the minimum network scope needed by the Skill. The authenticated network access ...[truncated 1493 chars]- Remediation
View remediation