T09 · Insecure Skill Coding Practices
- Location
scripts/run.py:45- Finding
Unrestricted LLM Endpoint Override Exposes API Credentials and Sensitive Health Data
- Content
View full analysis
Vulnerability Details
File Location:
scripts/run.py, lines 45–49, 207, and 221
Vulnerability Type: Server-Side Request Forgery and sensitive-data disclosure through an unrestricted API endpoint
Risk Level: HighVulnerable code:
python def make_llm_caller(appkey: str, base: str = DEFAULT_LLM_BASE, model: str = DEFAULT_LLM_MODEL, timeout: int = 0): url = f"{base.rstrip('/')}/chat/completions" headers = {"Authorization": f"Bearer {appkey}"} def llm(messages: List[Dict[str, str]]) -> str: payload = {"model": model, "messages": messages, "temperature": 0} resp = _http_post(url, payload, headers, timeout=timeout)python parser.add_argument("--base", default=DEFAULT_LLM_BASE, help=f"Internal LLM base URL (default: {DEFAULT_LLM_BASE}).")python llm = make_llm_caller(args.appkey, args.base, args.model, args.timeout)Technical Analysis
The command-line
--basevalue is used directly to construct the request destination without validating its scheme, hostname, port, or network range. The application then sends anAuthorization: Bearerheader containing the supplied platform credential to that destination. The request body also contains the complete health record submitted for chronic-disease screening.Consequently, any party able to control or influence the command-line arguments can redirect the request to an attacker-controlled server or an unintended internal service. Both HTTP and HTTPS destinations are accepted, so the credential and medical data may also be sent over an unencrypted connection. This violates destination-bound credential handling and least-disclosure principles.
Attack Path
- An attacker gains control over, or influences, the arguments used to invoke the Skill.
- The attacker sets
--baseto a server under their control, such ashttps://attacker.example/v1, or to an unencrypted HTTP endpoint. - The applicati ...[truncated 1159 chars]
- Remediation
View remediation
Remediation Suggestions
- Remove the
--baseoverride from production builds if endpoint customization is unnecessary. - Otherwise, enforce a strict allowlist of approved API hostnames and ports. Parse the URL with
urllib.parse.urlsplitand reject user-info components, fragments, unexpected paths, nonstandard ports, and all schemes except HTTPS. - Resolve the destination and reject loopback, link-local, private, multicast, reserved, and metadata-service address ranges unless a specifically approved internal endpoint requires them. Revalidate redirects or disable cross-origin redirects.
- Attach the bearer credential only after confirming that the final request destination is an approved origin. Never forward credentials across redirects to another host.
- Use endpoint-specific, short-lived, least-privilege credentials so one leaked key cannot access unrelated services.
- Redact or minimize health information before transmission and obtain appropriate authorization for external processing.
- Add automated tests confirming that attacker-controlled domains, plain HTTP URLs, embedded credentials, alternate ports, redirect-based bypasses, and internal IP literals are rejected.
- Remove the