T09 · Insecure Skill Coding Practices
- Location
SKILL.md:78- Finding
API Credentials and User Data May Be Routed to an Unverified Third-Party Endpoint
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 78-79
Vulnerability Type: Untrusted API endpoint configuration and unverifiable credential handling
Risk Level: MediumVulnerable Code:
bash export IMAGE_GEN_API_KEY="${API_KEY:?Please set the environment variable}" export IMAGE_GEN_BASE_URL="https://code.newcli.com/gemini" # Optional; this is the defaultTechnical Analysis
The Skill requires an image-generation API credential while configuring
https://code.newcli.com/geminias its default service endpoint. The documentation does not establish this domain as an official Gemini API endpoint or identify its operator and trust relationship.The project contains only
SKILL.md. The executable script referenced elsewhere in the document is absent, so the implementation that would process the credential, prompts, reference images, and API responses cannot be audited. Consequently, the following security properties cannot be verified:- Whether credentials are sent only in an appropriate authorization header.
- Whether credentials are forwarded to or retained by an intermediary.
- Whether the server hostname and TLS certificates are securely validated.
- Whether prompts and uploaded reference images are logged or retained.
- Whether redirects to additional hosts are permitted.
- Whether sensitive values can appear in errors, logs, or generated metadata.
Environment-variable storage protects the credential from direct hardcoding, but it does not protect the credential once an executable reads it and transmits it to an untrusted endpoint.
Attack Path
- A user follows the Skill documentation and assigns a valid credential to
IMAGE_GEN_API_KEY. - The user or Agent invokes the referenced image-generation implementation.
- The implementation reads
IMAGE_GEN_BASE_URL, whose documented default ishttps://code.newcli.com/gemini. - The implementation submits an authentica ...[truncated 1369 chars]
- Remediation
View remediation
Remediation Suggestions
- Use the official provider endpoint as the secure default and link to the provider's authoritative API documentation.
- Clearly identify the owner, purpose, privacy policy, and security model of any intermediary endpoint.
- Include the complete executable implementation in the Skill package so its request construction, redirects, logging, TLS behavior, and response handling can be reviewed.
- Enforce a strict hostname allowlist and reject unexpected schemes, hosts, ports, and user-information components.
- Require HTTPS with normal certificate and hostname verification; do not permit insecure TLS options.
- Disable cross-origin authorization forwarding and reject redirects unless every destination is explicitly trusted.
- Never forward an official provider credential to an intermediary. If an intermediary is required, use a separate, narrowly scoped token issued specifically for that service.
- Apply least privilege, spending limits, quota limits, expiration, and regular credential rotation.
- Ensure credentials are never included in command-line arguments, logs, error messages, generated image metadata, or output documents.
- Document prompt and image retention policies and obtain explicit user consent before transmitting sensitive reference images to a third party.