T09 · Insecure Skill Coding Practices
Error
- Location
- scripts/crawlora.sh:18
- Finding
- API Key Disclosure Through an Unrestricted API Base Override<![CDATA[ ## Vulnerability Details **File Location**: `scripts/crawlora.sh`, lines 18–46 **Vulnerability Type**: Unvalidated destination override causing credential disclosure **Risk Level**: High ### Vulnerable Code ```bash base="${CRAWLORA_API_BASE:-https://api.crawlora.net/api/v1}" method="GET" body="" args=() while [ $# -gt 0 ]; do case "$1" in -X) method="$2"; shift 2 ;; -d) body="$2"; shift 2 ;; *) args+=("$1"); shift ;; esac done [ "${#args[@]}" -ge 1 ] || { echo "usage: crawlora.sh [-X METHOD] /path [k=v ... | json-body]" >&2; exit 2; } path="${args[0]}" rest=("${args[@]:1}") auth=(-H "x-api-key: ${CRAWLORA_API_KEY}") if [ "$method" = "GET" ]; then # -G + --data-urlencode URL-encodes each value (so spaces etc. are safe). qs=() for kv in ${rest[@]+"${rest[@]}"}; do [ -n "$kv" ] && qs+=(--data-urlencode "$kv") done curl -fsS -G "${auth[@]}" "${qs[@]}" "${base}${path}" else [ -n "$body" ] || body="${rest[0]:-{}}" curl -fsS -X "$method" "${auth[@]}" \ -H "Content-Type: application/json" -d "$body" "${base}${path}" fi ``` ### Technical Analysis The script permits the request destination to be replaced through the inherited `CRAWLORA_API_BASE` environment variable. It does not validate the configured scheme, hostname, port, or path before constructing the request. At the same time, the script unconditionally adds the `CRAWLORA_API_KEY` value to the `x-api-key` header. Consequently, every invocation sends the credential to whichever server is selected by `CRAWLORA_API_BASE`, including an attacker-controlled server. This behavior contradicts the documented trust boundary in `SKILL.md`, which states that requests are sent to `https://api.crawlora.net/api/v1`. The vulnerability is exploitable when an attacker can influence the environment used to launch the skill, such as through a compromised wrapper, poisoned shell configuration, CI/CD variable, agent runner configuration, or deployment manifest. The helper als ...[truncated 1570 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. **Remove the destination override if it is not required.** Use a fixed API base: ```bash readonly base="https://api.crawlora.net/api/v1" ``` 2. **If configurability is required for testing, strictly allowlist destinations.** Reject every origin other than the explicitly approved HTTPS endpoint: ```bash base="${CRAWLORA_API_BASE:-https://api.crawlora.net/api/v1}" case "$base" in "https://api.crawlora.net/api/v1") ;; *) echo "Refusing untrusted CRAWLORA_API_BASE" >&2 exit 2 ;; esac ``` 3. **Use separate test credentials.** Test or staging destinations must never receive production API keys. Require a distinct environment variable and credential with minimal permissions for non-production environments. 4. **Constrain the request surface.** Since this skill documents read-only Reddit research, allow only `GET` requests and validate paths against the documented Reddit endpoint patterns. Reject absolute URLs, URL user information, unexpected schemes, control characters, and path traversal syntax. 5. **Preserve redirect safety.** Do not enable unrestricted redirect following while attaching authentication headers. If redirects become necessary, validate every destination and ensure credentials are never forwarded to a different origin. 6. **Harden launch environments.** Ensure CI/CD jobs, agent runners, wrappers, and deployment manifests cannot inject or override security-sensitive environment variables without authorization. ]]>