T09 · Insecure Skill Coding Practices
- Location
scripts/zqcc.sh:4- Finding
Unrestricted Base URL Allows AppKey Exfiltration
- Content
View full analysis
Vulnerability Details
File Location:
scripts/zqcc.sh, lines 4-6 and 33-41
Vulnerability Type: Credential exfiltration through an unvalidated destination
Risk Level: HighVulnerable Code
bash base_url="${ZQCC_BASE_URL:-https://zqcc.mkstone.club}" mcp_url="${base_url%/}/mcp/stream" chat_url="${base_url%/}/api/v1/chat" post_json() { local url="$1" local body="$2" curl --fail-with-body --silent --show-error \ --connect-timeout 15 \ --max-time 300 \ -X POST "$url" \ -H "Authorization: Bearer ${ZQCC_APP_KEY}" \ -H 'Content-Type: application/json' \ --data "$body" }Technical Analysis
The script accepts
ZQCC_BASE_URLwithout validating its scheme, hostname, port, or ownership. The resulting URLs are passed directly tocurl, while theZQCC_APP_KEYcredential is attached as a Bearer token.Consequently, an environment value can redirect authenticated
tools-list,tools-call, andchatrequests to an arbitrary endpoint. The destination may be an attacker-controlled HTTPS server or even a plaintext HTTP endpoint. This directly contradicts the security rule inSKILL.md, lines 104-105, which states that the AppKey must not be sent outside the trusted zqcc HTTPS domain.This is not shell command injection because the URL is quoted. The vulnerability is instead a trust-boundary failure: sensitive authentication data is transmitted to a destination selected by an unrestricted environment variable.
Attack Path
- An attacker gains the ability to influence the environment used to run the Skill, such as through a wrapper script, deployment configuration, poisoned environment file, or misleading setup instructions.
- The attacker sets
ZQCC_BASE_URLto an endpoint under their control, for example an attacker-operated HTTPS host. - The user or Agent runs
tools-list,tools-call, orchat. - The script constructs the MCP or Chat URL ...[truncated 779 chars]
- Remediation
View remediation
Remediation Suggestions
- Remove
ZQCC_BASE_URLconfigurability if alternate service endpoints are not required. - If customization is required, parse and validate the URL before constructing authenticated endpoints.
- Strictly allowlist trusted HTTPS origins, preferably only
https://zqcc.mkstone.club. - Reject plaintext HTTP, URL user information, fragments, unexpected ports, malformed URLs, and unapproved hostnames or subdomains.
- Configure curl to permit HTTPS only, including for redirects, using restrictions equivalent to
--proto '=https' --proto-redir '=https'. - Disable redirects or ensure credentials are never forwarded across origins.
- Resolve configuration from an administrator-controlled source rather than accepting untrusted per-invocation environment values.
- Add automated tests confirming that unapproved hosts, non-HTTPS schemes, deceptive suffix domains, and URLs containing user information are rejected before any request is sent.
- Remove