T09 · Insecure Skill Coding Practices
Warning
- Location
- SKILL.md:457
- Finding
- Configurable API Destination Can Receive Authentication Credentials and Sensitive Transaction Intent Data## Vulnerability Details **File Location**: `SKILL.md`, lines 457-479 **Vulnerability Type**: Sensitive information exposure through a configurable network destination **Risk Level**: Medium ### Vulnerable Code ```javascript const apiUrl = process.env.GUARDRAIL_API_URL ?? "https://agentguardrail.xyz"; // Pre-flight check before building a UserOperation const result = await fetch(`${apiUrl}/api/v1/validate`, { method: "POST", headers: { "Content-Type": "application/json", Authorization: `Bearer ${process.env.GUARDRAIL_DASHBOARD_API_KEY}`, }, body: JSON.stringify({ agent_id: "agent-uuid", action: { type: "swap", token: "0xA0b86991c6218b36c1d19D4a2e9Eb0cE3606eB48", protocol: "0x7a250d5630B4cF539739dF2C5dAcb4c659F2488D", amount: "500000000000000000", chain: 8453, to: "0xDef1C0ded9bec7F1a1670819833240f027b25EfF", }, }), }).then((r) => r.json()); ``` ### Technical Analysis The skill instructs the agent to send a bearer API key and detailed transaction intent to an endpoint controlled by `GUARDRAIL_API_URL`. The transmitted data includes the agent identifier, intended action, token, protocol, amount, chain, and recipient address. The destination defaults to the third-party service `https://agentguardrail.xyz`, while the environment variable permits replacing it with an arbitrary URL. The example does not validate the destination scheme or hostname, enforce TLS, or require explicit user confirmation before transmitting the data. Consequently, a configuration error or maliciously modified environment value could direct the bearer credential and transaction metadata to an attacker-controlled server. This behavior is not strictly necessary for the skill's core on-chain enforcement functionality. The document states that `PermissionEnforcer` performs authoritative validation on-chain and characterizes this API request as an optional pre-flight ...[truncated 2491 chars]
- Remediation
- ## Remediation Suggestions 1. Treat `GUARDRAIL_API_URL` as a security-sensitive setting and require explicit user or administrator approval before enabling a custom destination. 2. Validate the URL before every authenticated request: - Require `https:`. - Reject embedded credentials. - Reject unexpected ports. - Block loopback, link-local, private-network, and cloud-metadata destinations unless explicitly required for an approved self-hosted deployment. - Prefer an exact hostname allowlist or certificate-pinned service configuration. 3. Bind each API credential to its intended origin. Do not attach `GUARDRAIL_DASHBOARD_API_KEY` after redirects or when the resolved destination differs from the approved origin. 4. Disable automatic redirects for authenticated requests, or strip authorization headers on every cross-origin redirect. 5. Make API pre-flight validation opt-in. Default to direct on-chain validation and read-only RPC operations because these are sufficient for the declared enforcement model. 6. Prompt for confirmation before sending transaction intent to an off-chain service, clearly identifying the recipient and the fields that will be disclosed. 7. Minimize transmitted data. Use pseudonymous identifiers and omit recipient, amount, or protocol details when they are not essential to the requested validation. 8. Use narrowly scoped, short-lived API tokens with separate permissions for validation, audit access, deployment, and policy administration. 9. Update the privacy section to accurately disclose that validation requests transmit planned transaction data and may create off-chain audit records. 10. Add explicit error handling and fail closed if URL validation, TLS verification, or server authentication fails.