T09 · Insecure Skill Coding Practices
- Location
scripts/run.py:104- Finding
Unrestricted API Endpoint Can Receive Credentials and Sensitive Medical Content
- Content
View full analysis
Vulnerability Details
File Location:
scripts/run.py, lines 104–117; related configuration at lines 214, 218, 223, and invocation at lines 275–282
Vulnerability Type: Arbitrary outbound endpoint, credential disclosure, sensitive-data exposure, and potential SSRF
Risk Level: MediumVulnerable Code
python try: req = Request( api_url, data=json.dumps(payload, ensure_ascii=False).encode("utf-8"), headers={ "Content-Type": "application/json", "Authorization": f"Bearer {appkey}", }, ) resp = urlopen(req, timeout=timeout) body = json.loads(resp.read().decode("utf-8"))The endpoint and credential are accepted directly from command-line arguments:
python p.add_argument("--appkey", default="", help="内部医疗大模型鉴权 key。") p.add_argument("--api-url", default=DEFAULT_API_URL, help="OpenAI 兼容接口地址")They are then passed to the network request without endpoint validation:
python out["answer"] = call_llm( api_url=args.api_url, model=args.model, appkey=args.appkey, system_prompt=system_prompt_for(task_key, args.system_prompt), user_prompt=user_prompt, temperature=float(args.temperature), timeout=int(args.timeout), )Technical Analysis
The
--api-urloption accepts an arbitrary URL and passes it directly tourllib.request.urlopen(). The code does not enforce HTTPS, restrict the destination to an approved hostname, reject embedded URL credentials, or block loopback, link-local, and private-network destinations.Every request includes the user-supplied API key as a bearer credential. It also transmits the system prompt and the complete question, which may contain clinical records or other sensitive medical information.
Consequently, anyone who can influence the command-line configuration can redirect the request to an attacker-controlled server. A plaintext HTTP endpoint could also expose the request to network interception. If thi ...[truncated 1760 chars]
- Remediation
View remediation
Remediation Suggestions
-
Restrict destinations to approved HTTPS endpoints
- Parse the URL with
urllib.parse.urlsplit. - Require the scheme to be exactly
https. - Compare the normalized hostname against an explicit allowlist.
- Reject URLs containing embedded usernames or passwords.
- Parse the URL with
-
Prevent SSRF
- Resolve the destination hostname and reject loopback, link-local, private, multicast, reserved, and unspecified IP ranges.
- Revalidate destinations after redirects, or disable redirects entirely.
- Apply outbound firewall rules so the process can reach only approved API hosts.
-
Protect credentials
- Do not send a production API key when a custom endpoint is selected.
- Consider removing
--api-urlfrom normal operation and exposing custom endpoints only through trusted administrative configuration. - Load credentials from a protected secret store or environment variable rather than command-line arguments, which may be visible through process inspection or shell history.
- Use narrowly scoped, short-lived credentials and rotate any key suspected of exposure.
-
Protect medical data
- Require de-identification before transmission.
- Log only destination metadata and request identifiers; never log bearer tokens or complete clinical prompts.
- Document which approved external service receives the data and apply appropriate retention and access controls.
-
Fail securely
- Validate the endpoint before constructing the request.
- Return a clear error for unapproved schemes or hosts.
- Set explicit response-size limits and preserve the existing network timeout.
-