T09 · Insecure Skill Coding Practices
- Location
SKILL.md:71- Finding
GitHub Personal Access Token Disclosed to Non-GitHub Network Destinations
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 71, 88, 92, 98, 104, 117, 121, 127, 133, 139, 152, 156, 162, 168, 181, 185, 189, 213, 226, 238, 275, 283, and 300
Vulnerability Type: Credential disclosure through incorrect API destinations
Risk Level: CriticalVulnerable Code
Representative complete vulnerable requests include:
bash curl -H "Authorization: Bearer $GITHUB_TOKEN" https://api.userbash curl -H "Authorization: Bearer $GITHUB_TOKEN" \ "https://api.user/repos?sort=updated&per_page=10"bash curl -H "Authorization: Bearer $GITHUB_TOKEN" \ "https://api.repos/owner/repo"python response = requests.get( 'https://api.user/repos', headers=headers, params={'sort': 'updated', 'per_page': 10} )Technical Analysis
The Skill is intended to access the GitHub REST API, whose correct base URL is
https://api.github.com. The document correctly uses that destination in some later examples, but 23 other examples attach theGITHUB_TOKENbearer credential to unrelated or invalid hosts such asapi.user,api.repos, andapi.search.TLS only protects a request while it travels to the selected destination; it does not prevent the destination server from reading the
Authorizationheader. If one of these names resolves directly, through a configured DNS search suffix, or through attacker-influenced DNS or proxy infrastructure, the resulting server can receive the complete GitHub token. Even when the names do not resolve, instructing an agent to forward a credential to an unapproved host violates destination binding and least-privilege requirements.The behavior is unnecessary for the declared GitHub integration functionality. All authenticated requests should be restricted to the exact GitHub API hostname. The risk is aggravated by the Skill's recommendation that users grant broad
repo,read:org, andworkflowscopes....[truncated 1470 chars]
- Remediation
View remediation
Remediation Suggestions
- Replace every affected destination with an endpoint under the canonical base URL
https://api.github.com. - Construct requests from a fixed base URL rather than repeating manually entered hostnames.
- Parse and validate every outbound URL before attaching credentials. Require:
- The
httpsscheme. - An exact hostname match of
api.github.com. - No embedded user information.
- An expected port.
- The
- Do not forward
Authorizationheaders during redirects. Disable automatic redirects or revalidate the destination after every redirect. - Prefer fine-grained GitHub tokens restricted to the specific repositories and permissions required by each operation.
- Remove blanket recommendations for
repo,read:org, andworkflowaccess. Document operation-specific permissions instead. - Add automated documentation tests that extract URLs from command and Python examples and reject credential-bearing requests to unapproved hosts.
- Ensure logs, command tracing, exception output, and debugging tools redact the
Authorizationheader. - Revoke and replace any token that has already been used with an affected example, then inspect GitHub audit and security logs for unauthorized activity.
- Replace every affected destination with an endpoint under the canonical base URL