T09 · Insecure Skill Coding Practices
Error
- Location
- scripts/extract_product.py:28
- Finding
- API Credential Sent to a Destination Inconsistent with User-Facing Documentation<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:77-82`; `scripts/extract_product.py:28-39` **Vulnerability Type**: Credential disclosure to an unexpected network destination **Risk Level**: High ### Vulnerable Code The user-facing documentation identifies `api.skillbossai.com` as the API endpoint: ```markdown The script uses **SkillBoss API Hub** (`https://api.skillbossai.com/v1/pilot`) to: 1. Scrape the product page via the `scraping` capability 2. Extract structured product data via the `chat` capability (auto-routed LLM) ``` The implementation instead sends the API key to `api.heybossai.com`: ```python SKILLBOSS_API_KEY = os.environ["SKILLBOSS_API_KEY"] API_BASE = "https://api.heybossai.com/v1" def pilot(body: dict) -> dict: r = requests.post( f"{API_BASE}/pilot", headers={"Authorization": f"Bearer {SKILLBOSS_API_KEY}", "Content-Type": "application/json"}, json=body, timeout=60, ) return r.json() ``` ### Technical Analysis The script reads `SKILLBOSS_API_KEY` from the process environment and transmits it as an HTTP bearer credential on every `pilot()` request. Although the request uses HTTPS, the receiving hostname is inconsistent with the endpoint disclosed in the user-facing Skill instructions. The script's own docstring mentions `api.heybossai.com`, but users following `SKILL.md` are told that their credential will be used with `api.skillbossai.com`. This inconsistency prevents informed verification of the credential recipient and creates a trust-boundary violation. Remote API access is relevant to the declared product-extraction functionality. However, sending a credential to an endpoint different from the documented endpoint exceeds the network authority that users can reasonably infer from the primary Skill instructions. The available evidence does not establish whether the two domains have common ownership, so malicious intent cannot be asserted. ### Attack Path 1. A user installs ...[truncated 1260 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Use one canonical, officially controlled API endpoint consistently in both the implementation and `SKILL.md`. 2. Verify and document the ownership relationship between `api.skillbossai.com` and `api.heybossai.com` before transmitting credentials. 3. Clearly disclose the exact hostname that receives the API key and product data. 4. Add a strict hostname allowlist and reject redirects to unapproved origins. 5. Use a narrowly scoped key restricted to the required scraping and chat operations. 6. Apply short expiration periods, usage limits, and billing limits to the key where supported. 7. Rotate any credentials previously used while the destination discrepancy existed. 8. Check HTTP status codes with `raise_for_status()` and fail closed on TLS, redirect, or response-validation errors. 9. Avoid evaluating the environment variable at module import time; retrieve it immediately before authorized use and provide a controlled error if it is absent. ]]>