T09 · Insecure Skill Coding Practices
Error
- Location
scripts/emr_qc_impl.py:58- Finding
Unrestricted LLM Endpoint Can Exfiltrate API Credentials and Medical Records
- Content
View full analysis
str: payload = {"model": model, "messages": messages, "temperature": 0} resp = _http_post(url, payload, headers, timeout=timeout) ``` The endpoint is exposed through an unrestricted command-line argument: ```python parser.add_argument( "--base", default=DEFAULT_LLM_BASE, help=f"LLM base URL (default: {DEFAULT_LLM_BASE}).", ) ``` ### Technical Analysis The `--base` parameter accepts an arbitrary URL. The application appends `/chat/completions` and sends both of the following to that destination: - The application key in the `Authorization: Bearer` header. - EMR-derived content in the request payload. No destination hostname allowlist is applied. The implementation also does not explicitly reject plaintext HTTP URLs, embedded URL credentials, loopback destinations, private network addresses, or redirects to untrusted destinations. Although custom endpoint support may be intentional, using the same sensitive application credential for every caller-selected destination crosses a security boundary. Any party capable of influencing the command-line invocation or wrapper configuration can redirect credentials and medical data to infrastructure under its control. ### Attack Path 1. An attacker gains influence over the Skill invocation, a wrapper script, job configuration, or copied command. 2. The attacker supplies a destination ...[truncated 1214 chars]- Remediation
View remediation