T09 · Insecure Skill Coding Practices
Warning
- Location
- scripts/run.py:99
- Finding
- Unrestricted API Endpoint Can Receive Bearer Credentials and Sensitive Medical Data<![CDATA[ ## Vulnerability Details **File Location**: `scripts/run.py:99-104`, `scripts/run.py:229`, `scripts/run.py:233`, and `scripts/run.py:284-291` **Vulnerability Type**: Unrestricted transmission of credentials and sensitive input to a user-controlled endpoint **Risk Level**: Medium ### Vulnerable Code ```python req = Request( api_url, data=json.dumps(payload, ensure_ascii=False).encode("utf-8"), headers={ "Content-Type": "application/json", "Authorization": f"Bearer {appkey}", }, ) ``` ```python p.add_argument("--appkey", default="", help="内部医疗大模型鉴权 key。") p.add_argument("--api-url", default=DEFAULT_API_URL, help="OpenAI 兼容接口地址") ``` ```python out["answer"] = call_llm( api_url=args.api_url, model=args.model, appkey=args.appkey, system_prompt=system_prompt_for(task_key, args.system_prompt), user_prompt=user_prompt, temperature=float(args.temperature), timeout=int(args.timeout), ) ``` ### Technical Analysis The script permits callers to supply an arbitrary destination through `--api-url`. It then sends an HTTP request to that destination containing: - The complete medical question in the request body. - The selected system prompt and model settings. - The supplied API credential in the `Authorization: Bearer` header. No validation requires HTTPS, restricts the destination hostname to the intended provider, or prevents a provider credential from being forwarded to a custom endpoint. Consequently, a malicious command, wrapper script, or unsafe integration configuration can redirect both the API credential and potentially sensitive medical content to an attacker-controlled server. Accepting the credential through `--appkey` also increases incidental exposure risk because command-line arguments may be retained in shell history or visible to local process-inspection mechanisms. ### Attack Path 1. An attacker supplies or recommends a modified invocation, integration configuration, or wrapper ...[truncated 1342 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. **Restrict endpoint destinations by default** - Parse the URL with `urllib.parse.urlparse`. - Require the `https` scheme. - Allow only explicitly approved hostnames, such as the default provider hostname. - Reject embedded credentials, unexpected ports, malformed hosts, and non-HTTP schemes. 2. **Separate credentials by provider** - Do not forward the default provider credential when a custom endpoint is selected. - If custom endpoints are required, require a separately named credential and an explicit opt-in flag. - Display a clear warning that prompts and credentials will be transmitted to a non-default service. 3. **Avoid command-line secret exposure** - Read the API key from a protected environment variable, secret manager, or secure standard-input mechanism. - Retain `--appkey` only if required for compatibility, mark it as discouraged, and document the shell-history and process-list risks. 4. **Minimize sensitive-data transmission** - Require callers to de-identify medical content before transmission. - Avoid logging credentials and minimize retention of questions and responses. - Clearly identify the destination before sending patient-related content. 5. **Fail securely** - Reject plaintext HTTP endpoints. - Abort when the endpoint is outside the approved allowlist unless a deliberate administrative override is enabled. - Add tests confirming that disallowed schemes and hosts cannot receive an authorization header. ]]>