T09 · Insecure Skill Coding Practices
- Location
SKILL.md:22- Finding
Unrestricted API Base URL Can Exfiltrate Skylight Credentials and Authorization Tokens
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md:22-63
Additional Documentation Location:README.md:7-22
Vulnerability Type: User-controlled credential transmission destination
Risk Level: High
Category: T09: Insecure Skill Coding PracticesVulnerable Code
bash Set environment variables: - `SKYLIGHT_URL`: Base URL (default: `https://app.ourskylight.com`) - `SKYLIGHT_FRAME_ID`: Your frame (household) ID — find this by logging into [ourskylight.com](https://ourskylight.com/), clicking your calendar, and copying the number from the URL (e.g., `4197102` from `https://ourskylight.com/calendar/4197102`) **Authentication (choose one):** Option A - Email/Password (recommended): - `SKYLIGHT_EMAIL`: Your Skylight account email - `SKYLIGHT_PASSWORD`: Your Skylight account password Option B - Pre-captured token: - `SKYLIGHT_TOKEN`: Full Authorization header value (e.g., `Basic abc123...`) ## Authentication ### Option A: Login with Email/Password (Recommended) Generate a token by logging in with email and password: ```bash # Login and get user credentials LOGIN_RESPONSE=$(curl -s -X POST "$SKYLIGHT_URL/api/sessions" \ -H "Content-Type: application/json" \ -d '{ "email": "'"$SKYLIGHT_EMAIL"'", "password": "'"$SKYLIGHT_PASSWORD"'", "name": "", "phone": "", "resettingPassword": "false", "textMeTheApp": "true", "agreedToMarketing": "true" }') # Extract user_id and user_token from response USER_ID=$(echo "$LOGIN_RESPONSE" | jq -r '.data.id') USER_TOKEN=$(echo "$LOGIN_RESPONSE" | jq -r '.data.attributes.token') # Generate Basic auth token (base64 of user_id:user_token) SKYLIGHT_TOKEN="Basic $(echo -n "${USER_ID}:${USER_TOKEN}" | base64)" # Now use $SKYLIGHT_TOKEN for all API requeststext The same unsafe configuration model is documented in `README.md`: ```bash export SKYLIGHT_EMAIL="your_email@example.com" export SKYLIGHT_PASSWORD="your_password" export SKYLIGHT_FRAME_ID="your_frame_id" export ...[truncated 3006 chars]- Remediation
View remediation
Remediation Suggestions
-
Remove arbitrary origin configuration where possible. Hardcode the supported API origin:
bash SKYLIGHT_URL="https://app.ourskylight.com" -
Strictly validate any necessary override. Parse and compare the complete destination before handling credentials. Require:
- Scheme:
https - Hostname:
app.ourskylight.com - Expected default port only
- No embedded username or password
- No untrusted path prefix
- No lookalike, suffix, or subdomain matching
- Scheme:
-
Constrain
curltransport behavior. Use options such as:bash curl --proto '=https' --proto-redir '=https' --max-redirs 0 ...Redirects should remain disabled for requests containing passwords or authorization headers unless every redirect target is independently validated.
-
Fail closed before accessing secrets. Validate the destination before expanding or reading
SKYLIGHT_EMAIL,SKYLIGHT_PASSWORD, orSKYLIGHT_TOKEN. -
Prefer limited, revocable authentication. If supported by the service, use an official OAuth flow or narrowly scoped API token instead of collecting the account password or using a broad reusable token.
-
Protect credentials operationally. Retrieve secrets from a dedicated secret manager, avoid printing responses or authorization headers, prevent shell tracing while handling secrets, and unset temporary variables after use.
-
Document token handling clearly. State that Base64 is encoding rather than encryption, that the complete Basic authorization value must be treated as a password, and that users should revoke or rotate it after suspected disclosure.
-
Harden the proxy-capture alternative. Recommend only trusted proxy software in an isolated environment, removal of the interception CA immediately afterward, and revocation of captured tokens when no longer needed.
-