T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/eagle-api-cli.js:1342- Finding
Unrestricted API Endpoint Redirection and Plaintext Transmission
- Content
View full analysis
{ ``` ### Technical Analysis The Skill is documented as communicating with the local Eagle API at `127.0.0.1:41596`, but the implementation allows the destination to be replaced by either the `EAGLE_SERVER_URL` environment variable or the `--server` command-line option. The supplied URL is accepted without validating: - Whether the destination is a loopback address. - Whether the port is the expected Eagle API port. - Whether the URL contains an unexpected remote or internal-network host. - Whether the protocol is HTTP or HTTPS. - Whether user approval was obtained before transmitting data remotely. The selected hostname and port are then passed directly to `http.request`. This permits requests to attacker-controlled hosts or other reachable internal HTTP services. It also creates a plaintext transmission problem: the code always uses Node.js's `http` module, even i ...[truncated 2090 chars]- Remediation
View remediation