T09 · Insecure Skill Coding Practices
Warning
- Location
- scripts/crawlora.sh:18
- Finding
- API Key Disclosure Through an Unrestricted API Base Override<![CDATA[ ## Vulnerability Details **File Location**: `scripts/crawlora.sh`, lines 18–47 **Vulnerability Type**: Attacker-controlled credential destination **Risk Level**: Medium ### Vulnerable Code ```bash base="${CRAWLORA_API_BASE:-https://api.crawlora.net/api/v1}" method="GET" body="" args=() while [ $# -gt 0 ]; do case "$1" in -X) method="$2"; shift 2 ;; -d) body="$2"; shift 2 ;; *) args+=("$1"); shift ;; esac done [ "${#args[@]}" -ge 1 ] || { echo "usage: crawlora.sh [-X METHOD] /path [k=v ... | json-body]" >&2; exit 2; } path="${args[0]}" rest=("${args[@]:1}") auth=(-H "x-api-key: ${CRAWLORA_API_KEY}") if [ "$method" = "GET" ]; then # -G + --data-urlencode URL-encodes each value (so spaces etc. are safe). qs=() for kv in ${rest[@]+"${rest[@]}"}; do [ -n "$kv" ] && qs+=(--data-urlencode "$kv") done curl -fsS -G "${auth[@]}" ${qs[@]+"${qs[@]}"} "${base}${path}" else [ -n "$body" ] || body="${rest[0]:-}" [ -n "$body" ] || body='{}' curl -fsS -X "$method" "${auth[@]}" \ -H "Content-Type: application/json" -d "$body" "${base}${path}" fi ``` ### Technical Analysis The script permits the `CRAWLORA_API_BASE` environment variable to replace the expected API origin, `https://api.crawlora.net/api/v1`. No validation restricts the replacement value to HTTPS or to the trusted `api.crawlora.net` host. The script separately constructs an authentication header containing `CRAWLORA_API_KEY` and attaches it to every request. Consequently, the credential is sent to whichever destination is supplied through `CRAWLORA_API_BASE`. This creates a credential-exfiltration vulnerability when an attacker can influence the execution environment, such as through a poisoned shell profile, CI/CD variable, process launcher, or wrapper script. The API-base override is also not documented in `SKILL.md`, making unexpected redirection harder for users to identify. ### Attack Path 1. The attacker gains the ability to define or influence env ...[truncated 1321 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. **Remove the configurable base URL if it is not required.** ```bash readonly base="https://api.crawlora.net/api/v1" ``` 2. **If an override is operationally necessary, validate it before constructing authentication headers.** Require: - The `https` scheme. - The exact `api.crawlora.net` hostname. - The expected API path. - No URL user information. - No unexpected port. - No query string or fragment. 3. **Constrain curl to HTTPS and avoid cross-origin redirects.** ```bash curl --proto '=https' --max-redirs 0 ... ``` Alternatively, redirects may be permitted only after validating that every destination remains on the allowlisted origin. Do not forward the authentication header to another host. 4. **Fail closed on invalid configuration.** Terminate with a clear error rather than silently sending an authenticated request to an untrusted destination. 5. **Document any supported configuration override** in `SKILL.md`, including its security implications and accepted values. 6. **Rotate the API key** if the script has previously run with an unknown or untrusted `CRAWLORA_API_BASE` value. ]]>