T09 · Insecure Skill Coding Practices
Warning
- Location
- scripts/generate.js:3
- Finding
- Unvalidated API Base Override Can Exfiltrate API Credentials and Music Prompts<![CDATA[ ## Vulnerability Details **File Location**: `scripts/generate.js`, lines 3-36 **Vulnerability Type**: Unrestricted network destination with sensitive authorization data **Risk Level**: Medium ### Vulnerable Code ```js const API_BASE = process.env.MBM_API_BASE || "https://api.makebestmusic.com"; const API_KEY = process.env.apiKey; ``` ```js const res = await fetch(`${API_BASE}/api/skill/generate_music`, { method: "POST", headers: { "Content-Type": "application/json", Authorization: `Bearer ${API_KEY}`, }, body: JSON.stringify({ model: "Fi", custom: true, instrumental: instrumental, prompt: prompt, title: "", style: "", advance: { vocal_gender: "", ai_lyrics: true } }), }); ``` ### Technical Analysis The generation operation legitimately needs to send the configured API key and user-provided music prompt to MakebestMusic. However, the destination is derived from the undocumented `MBM_API_BASE` environment variable without validating its protocol or hostname. An attacker or compromised component capable of influencing the process environment can replace the intended API origin with an arbitrary server. The script will then attach the MakebestMusic bearer credential and transmit the user's prompt to that server. The override can also specify an unencrypted HTTP URL, allowing interception of the credential and prompt in transit. This behavior exceeds the minimum privileges required by the declared functionality. Production music generation only requires communication with the fixed MakebestMusic HTTPS API. ### Attack Path 1. An attacker gains the ability to influence the environment used to launch the Skill, such as through compromised workspace configuration, another privileged component, or operator deception. 2. The attacker sets `MBM_API_BASE` to an attacker-controlled URL, for example `https://attacker.example`. 3. A user requests music generation. 4. The script sends a POST request ...[truncated 835 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Remove the production endpoint override and use a fixed trusted origin: ```js const API_BASE = "https://api.makebestmusic.com"; ``` 2. If an override is operationally necessary, parse and validate it before making any request: ```js const DEFAULT_API_BASE = "https://api.makebestmusic.com"; const ALLOWED_HOSTS = new Set(["api.makebestmusic.com"]); function getApiBase() { const url = new URL(process.env.MBM_API_BASE || DEFAULT_API_BASE); if (url.protocol !== "https:" || !ALLOWED_HOSTS.has(url.hostname)) { throw new Error("Invalid API endpoint"); } return url.origin; } const API_BASE = getApiBase(); ``` 3. Never attach the authorization header until the final request URL has been checked against an explicit HTTPS origin allowlist. 4. Keep development and test endpoints separate from production configuration and use non-production credentials for testing. 5. Document all supported environment variables and their security implications. 6. Apply least privilege and usage limits to API keys, and rotate the credential if it may have been used while an untrusted endpoint override was present. ]]>