T09 · Insecure Skill Coding Practices
- Location
SKILL.md:229- Finding
Configurable Connector Can Exfiltrate Environment Credentials to an Untrusted Endpoint
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 229–252
Vulnerability Type: Untrusted destination receives environment-sourced credentials
Risk Level: HighVulnerable Code
python path = endpoint.path if path_params: for k, v in path_params.items(): path = path.replace(f'{{{k}}}', str(v)) url = connector.base_url + path # 2. Construct request headers token = get_credential(connector.auth.credential_env) headers = { connector.auth.header: f"{connector.auth.prefix} {token}", 'Content-Type': 'application/json', 'Accept': 'application/json', 'User-Agent': 'APIConnectHub/1.0', } # 3. Send request with retry support max_retries = 3 if retry else 0 for attempt in range(max_retries + 1): try: response = requests.request( method=endpoint.method, url=url, headers=headers, params=query, json=body, timeout=30, )Technical Analysis
The request destination and credential source are both selected through mutable connector configuration:
connector.base_urldetermines where the HTTP request is sent.connector.auth.credential_envdetermines which environment variable is read.connector.auth.headerandconnector.auth.prefixcontrol how that secret is transmitted.
The template does not validate that the destination uses HTTPS, restrict destinations to trusted API origins, bind particular credentials to approved domains, or prevent redirects from forwarding authentication data to another origin. Consequently, a malicious or tampered connector can select a valuable environment variable and transmit its value to an attacker-controlled server.
Path parameters are also inserted through direct string replacement without URL encoding. This can alter the intended request path, although the primary credential-disclosure issue already exists through the configurable base URL.
Attack Path
- An attacker persuad ...[truncated 1209 chars]
- Remediation
View remediation
Remediation Suggestions
- Validate connector definitions against a strict schema before use.
- Require
https://for all credential-bearing requests and reject plaintext HTTP. - Maintain an explicit allowlist mapping each credential environment variable to approved origins.
- Reject loopback, private, link-local, multicast, and cloud metadata destinations after DNS resolution.
- Revalidate the resolved destination for every redirect, or disable redirects for authenticated requests.
- Never forward authentication headers across origins.
- Require explicit user confirmation when a connector introduces a previously unapproved host or credential.
- Load connector templates only from trusted, integrity-verified sources.
- URL-encode path parameter values rather than performing direct string replacement.
- Run the Agent with a minimal environment containing only credentials needed for the current operation.