T09 · Insecure Skill Coding Practices
Warning
- Location
- SKILL.md:209
- Finding
- User-Controlled API Endpoint Can Receive Payment Credentials and Sensitive Query Data<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:209-212` **Vulnerability Type**: Untrusted endpoint configuration used for authenticated requests **Risk Level**: Medium ### Vulnerable Code ```bash curl -X POST $ARGUS_ENDPOINT/api/v1/token/analyze \ -H "Content-Type: application/json" \ -H "X-Stripe-Token: sk_argus_xxxx" \ -d '{"token": "0xabc...", "chain": "ethereum"}' ``` ### Technical Analysis The documented command sends the `X-Stripe-Token` payment credential to a destination derived entirely from the environment-controlled `ARGUS_ENDPOINT` variable. The example does not validate that the variable uses HTTPS or that its hostname is the expected `argus.getfailsafe.com` service. If an attacker, compromised automation environment, or malicious configuration can modify `ARGUS_ENDPOINT`, subsequent requests following this example will transmit the Stripe token and request body to the attacker-selected server. The missing shell quoting can additionally cause unintended word splitting or pathname expansion, although it does not by itself establish arbitrary shell-command execution. The same endpoint configuration is used elsewhere for prompts, blockchain addresses, social identifiers, agent identifiers, and payment proofs. Consequently, endpoint substitution may expose more than the illustrated token-analysis request. ### Attack Path 1. An attacker gains the ability to influence the environment or configuration from which the Skill reads `ARGUS_ENDPOINT`. 2. The attacker changes it from the documented service to an attacker-controlled HTTPS endpoint. 3. A user or agent invokes the paid endpoint according to the documented example and supplies a valid `X-Stripe-Token`. 4. `curl` sends the payment credential and request body to the attacker-controlled server. 5. The attacker captures the token and may consume associated service credits or collect sensitive intelligence-query data. This path requires prior influence over the environme ...[truncated 771 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Avoid using an unrestricted environment variable as the destination for authenticated requests. Prefer a fixed trusted origin: ```bash ARGUS_ENDPOINT="https://argus.getfailsafe.com" curl --proto '=https' \ -X POST "${ARGUS_ENDPOINT}/api/v1/token/analyze" \ -H "Content-Type: application/json" \ -H "X-Stripe-Token: ${ARGUS_STRIPE_TOKEN}" \ -d '{"token": "0xabc...", "chain": "ethereum"}' ``` 2. If endpoint configurability is required, validate the parsed URL before sending credentials: - Require the `https` scheme. - Require the exact expected hostname and port. - Reject embedded user information, unexpected ports, and malformed URLs. - Do not rely on substring or suffix-only hostname checks. 3. Quote every expansion as `"${ARGUS_ENDPOINT}/..."` to prevent shell word splitting and pathname expansion. 4. Apply a restrictive redirect policy. Do not enable redirect following for authenticated requests unless necessary, and never forward the custom payment header to a different origin. 5. Store the Stripe token in a dedicated secret variable or secret manager. Avoid placing real tokens directly in command history, logs, source files, or process arguments where feasible. 6. Document that users must not submit private keys, seed phrases, authentication tokens, confidential prompts, or unnecessary personal information to remote analysis endpoints. 7. Consider implementing a trusted local wrapper that validates the destination and adds credentials only after successful origin verification, rather than asking users or agents to construct authenticated `curl` requests directly. ]]>