T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/gen.py:27- Finding
API Credentials and Prompts Can Be Transmitted to an Arbitrary Configured Endpoint
- Content
View full analysis
str: base = ( os.environ.get("OPENAI_BASE_URL") or os.environ.get("OPENAI_API_BASE") or "https://api.openai.com" ).rstrip("/") if base.endswith("/v1"): return f"{base}/images/generations" return f"{base}/v1/images/generations" ``` ```python def _post_json(url: str, api_key: str, payload: dict, timeout_s: int) -> dict: body = json.dumps(payload).encode("utf-8") req = urllib.request.Request( url, data=body, headers={ "Authorization": f"Bearer {api_key}", "Content-Type": "application/json", }, method="POST", ) ``` ### Technical Analysis The Skill legitimately needs to send prompts and an API credential to the OpenAI Images API. However, `_api_url()` permits the destination to be replaced entirely through `OPENAI_BASE_URL` or `OPENAI_API_BASE`. No validation restricts the configured endpoint to an approved hostname or requires HTTPS. `_post_json()` subsequently sends the API key as a Bearer credential and places the image-generation prompt in the request body. Consequently, a poisoned or incorrectly configured environment can redirect both values to an untrusted server. This behavior exceeds the minimum privilege needed when the supplied credential is specifically an OpenAI API key. Support for OpenAI-compatible endpoints may be intentional, but credentials should be scoped to those endpoints and the change in trust boundary should be explicit. The current implementation can also accept an `http://` endpoint, permitting plaintext interception of the credential and prompt. ### Attack Path 1. An attacker compromises a launcher, shell profile, task configuration, development envi ...[truncated 1397 chars]- Remediation
View remediation