T09 · Insecure Skill Coding Practices
Warning
- Location
gen_cover_volc.py:63- Finding
Bearer Credential and Reference Images Can Be Sent to an Unrestricted Configurable Endpoint
- Content
View full analysis
1 else refs[0] print(f"-> 参考图数量: {len(refs)}") data = json.dumps(body).encode("utf-8") req = urllib.request.Request(url, data=data, method="POST") req.add_header("Content-Type", "application/json") req.add_header("Authorization", "Bearer " + api_key) print(f"-> POST {url}") print(f"-> model={args.model} size={args.size} watermark=False") try: with urllib.request.urlopen(req, timeout=180) as resp: ``` ### Technical Analysis The script reads `ARK_BASE_URL` from `~/.baoyu-skills/.env` and uses it without validating its scheme or destination host. It then attaches the ARK bearer credential to the request and submits the user's prompt and any selected reference images. Reference images are base64-encoded as required by the image-generation API. That encoding is legitimate functionality rather than an independent covert channel. However, because the destination is unrestricted, these encoded files can be delivered to an unintended or attacker-controlled service. The implementation does not require HTTPS, does not restrict the endpoint to the documented Volcengine ARK host, and does not distinguish between a trusted pro ...[truncated 2055 chars]- Remediation
View remediation