T09 · Insecure Skill Coding Practices
Warning
- Location
- lib/client.js:5
- Finding
- Unvalidated Custom API Endpoint May Expose Credentials and User Content<![CDATA[ ## Vulnerability Details **File Location**: `lib/client.js:5-15` **Vulnerability Type**: Arbitrary credential-bearing API endpoint configuration **Risk Level**: Medium ### Vulnerable Code ```js this.accessKey = options.accessKey || process.env.LIBLIBAI_ACCESS_KEY; this.secretKey = options.secretKey || process.env.LIBLIBAI_SECRET_KEY; this.baseURL = options.baseURL || process.env.LIBLIBAI_BASE_URL || 'https://openapi.liblibai.cloud'; if (!this.accessKey || !this.secretKey) { throw new Error('LiblibAI credentials not found. Set LIBLIBAI_ACCESS_KEY and LIBLIBAI_SECRET_KEY environment variables or pass them as options.'); } this.client = new LiblibAI({ apiKey: this.accessKey, apiSecret: this.secretKey, baseURL: this.baseURL, }); ``` The related documentation in `SKILL.md:27-31` exposes `LIBLIBAI_BASE_URL` as a configurable endpoint: ```yaml - name: LIBLIBAI_BASE_URL description: API endpoint URL (default: https://openapi.liblibai.cloud) default: https://openapi.liblibai.cloud optional: true ``` The documentation also recommends switching to an unspecified mirror in `SKILL.md:211-213`: ```markdown ### Network timeout Users in China may need a proxy to access the international API. **Solution**: Set `LIBLIBAI_BASE_URL` to a domestic mirror, if available, or use a stable network. ``` ### Technical Analysis The client reads an arbitrary base URL from constructor options or the `LIBLIBAI_BASE_URL` environment variable without validating its scheme or hostname. It then initializes the third-party SDK with that endpoint and the user's LiblibAI access key and secret key. Authentication against the official LiblibAI API is necessary for the declared image-generation functionality. However, allowing credentials to be associated with any caller-selected endpoint exceeds the minimum privilege required. The vague recommendation to use an unspecified mirror increases the likelihood that users will direct authenticated requests to an untrusted ...[truncated 2069 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. **Use the official endpoint by default and enforce an allowlist.** Accept only explicitly trusted HTTPS hostnames, such as `openapi.liblibai.cloud`. 2. **Validate URLs before client initialization.** Reject malformed URLs, embedded credentials, non-HTTPS schemes, unexpected ports, IP literals, localhost, private-network destinations, and unapproved hostnames. ```js const OFFICIAL_HOSTS = new Set(['openapi.liblibai.cloud']); const parsedBaseURL = new URL(this.baseURL); if ( parsedBaseURL.protocol !== 'https:' || !OFFICIAL_HOSTS.has(parsedBaseURL.hostname) || parsedBaseURL.username || parsedBaseURL.password ) { throw new Error('Untrusted LiblibAI API endpoint'); } ``` 3. **Do not attach production credentials to arbitrary endpoints.** If custom enterprise endpoints are required, maintain a separate administrator-controlled allowlist and require explicit approval before credentials are used. 4. **Remove the unspecified mirror recommendation.** Documentation should identify only officially operated and verified endpoints. It should warn that custom endpoints can receive authentication data, prompts, and uploaded files. 5. **Require explicit confirmation for endpoint overrides.** For interactive use, display the destination hostname and require confirmation. In automated environments, require a separate opt-in setting controlled by an administrator. 6. **Avoid insecure transport and redirects.** Enforce TLS certificate validation and ensure the SDK does not forward authentication information across redirects to a different origin. 7. **Rotate potentially exposed credentials.** Users who previously configured unknown mirrors should revoke and recreate their LiblibAI access and secret keys, then review account usage for unauthorized activity. 8. **Add security tests.** Verify rejection of HTTP URLs, look-alike domains, embedded credentials, localhost, private IP ranges, unexpected ports, and redirects to untrusted ...[truncated 15 chars]