T09 · Insecure Skill Coding Practices
Error
- Location
- scripts/artboard.sh:5
- Finding
- Bearer credential disclosure through an unrestricted API endpoint override<![CDATA[ ## Vulnerability Details **File Location**: `scripts/artboard.sh:5-39` **Vulnerability Type**: Unrestricted credential destination / insecure configuration **Risk Level**: High ### Vulnerable Code ```bash API_BASE="${ARTBOARD_API_URL:-https://moltboard.art/api}" CRED_FILE="${HOME}/.config/artboard/credentials.json" # Load API key from credentials file API_KEY="" if [[ -f "$CRED_FILE" ]]; then if command -v jq &> /dev/null; then API_KEY=$(jq -r '.api_key // empty' "$CRED_FILE" 2>/dev/null) else API_KEY=$(grep '"api_key"' "$CRED_FILE" | sed 's/.*"api_key"[[:space:]]*:[[:space:]]*"\([^"]*\)".*/\1/') fi fi ensure_creds() { if [[ -z "$API_KEY" || "$API_KEY" == "null" ]]; then echo "Error: Credentials not found" >&2 echo "Run: bash artboard.sh register YOUR_NAME \"Your description\"" >&2 exit 1 fi } api_get() { local endpoint="$1" curl -s "${API_BASE}${endpoint}" \ -H "Authorization: Bearer ${API_KEY}" \ -H "Content-Type: application/json" } api_post() { local endpoint="$1" local data="$2" curl -s -X POST "${API_BASE}${endpoint}" \ -H "Authorization: Bearer ${API_KEY}" \ -H "Content-Type: application/json" \ -d "$data" } ``` The override is documented in `INSTALL.md:40-44`: ```markdown | Variable | Default | Description | |----------|---------|-------------| | `ARTBOARD_API_URL` | `https://moltboard.art/api` | Override API base URL | ``` This conflicts with the security claim in `INSTALL.md:69-71`: ```markdown ## Security - Credentials stored locally in `~/.config/artboard/credentials.json` - File permissions set to 600 (owner-only read/write) - API key only sent to `https://moltboard.art` ``` ### Technical Analysis The script reads an API key from `~/.config/artboard/credentials.json`, but the destination receiving that key is controlled by the inherited `ARTBOARD_API_URL` environment variable. No validation requires the conf ...[truncated 2207 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Remove `ARTBOARD_API_URL` support if custom endpoints are not essential. 2. If overrides are required, validate the parsed URL before making any authenticated request: - Require the `https` scheme. - Require an exact approved hostname and port. - Reject embedded credentials, unexpected ports, and lookalike domains. 3. Separate public and authenticated base URLs. Never attach the bearer token unless the final destination matches an explicit trusted-origin allowlist. 4. Require a separate credential for development or self-hosted endpoints instead of reusing the production token. 5. Fail closed with a clear warning when an untrusted override is detected. 6. Update `INSTALL.md` to disclose the override behavior accurately. 7. Consider supporting an explicit credential environment variable or secure secret provider for isolated automation environments, while retaining restrictive file permissions for local storage. 8. Rotate existing API keys if there is reason to believe the script has been run with an untrusted endpoint override. ]]>