T09 · Insecure Skill Coding Practices
- Location
scripts/run.py:96- Finding
Bearer Credential and Medical Data Exposure Through Unrestricted API Endpoint Configuration
- Content
View full analysis
Vulnerability Details
File Location:
scripts/run.py:96-110,scripts/run.py:221-222,scripts/run.py:277-285; supporting documentation atSKILL.md:45-46,55
Vulnerability Type: Credential exposure and transmission of sensitive data to an unrestricted endpoint
Risk Level: HighVulnerable Code
scripts/run.py:96-110:python try: req = Request( api_url, data=json.dumps(payload, ensure_ascii=False).encode("utf-8"), headers={ "Content-Type": "application/json", "Authorization": f"Bearer {appkey}", }, ) resp = urlopen(req, timeout=timeout) body = json.loads(resp.read().decode("utf-8")) except HTTPError as exc: detail = exc.read().decode("utf-8", errors="replace")[:2000] raise RuntimeError(f"API HTTP {exc.code}: {detail}") from excscripts/run.py:221-222:python p.add_argument("--appkey", default="", help="内部医疗大模型鉴权 key。") p.add_argument("--api-url", default=DEFAULT_API_URL, help="OpenAI 兼容接口地址")scripts/run.py:277-285:python out["answer"] = call_llm( api_url=args.api_url, model=args.model, appkey=args.appkey, system_prompt=system_prompt_for(task_key, args.system_prompt), user_prompt=user_prompt, temperature=float(args.temperature), timeout=int(args.timeout), )SKILL.md:45-46:bash # 指定任务类型与题干 python3 scripts/run.py --task insure-calc --question "题干……" --appkey YOUR_KEYSKILL.md:55:markdown - `--appkey STRING`：**必填**（`--dry-run` 时除外）。内部医疗大模型鉴权 key。Technical Analysis
The application accepts the authentication key directly through the
--appkeycommand-line argument. Command-line secrets can be retained in shell history and may be visible in process inspection, execution logs, monitoring systems, job definitions, or diagnostic output available to other local users and administrato ...[truncated 2637 chars]- Remediation
View remediation
Remediation Suggestions
-
Remove command-line secret handling
- Read the credential from a protected environment variable, operating-system credential store, or secrets manager.
- If file-based credentials are supported, require restrictive file permissions and avoid printing the file contents.
- Update
SKILL.mdso examples do not encourage placing credentials in shell history.
-
Restrict API destinations
- Permit only HTTPS URLs.
- Validate the parsed URL before constructing the request.
- Maintain an explicit allowlist of trusted API hostnames and, where practical, approved ports and paths.
- Reject embedded URL credentials, malformed hostnames, IP literals when unnecessary, and unapproved destination ports.
- Do not send production credentials to arbitrary custom endpoints. If custom endpoints are required, require separate endpoint-specific credentials.
-
Harden redirect behavior
- Reject redirects or validate every redirect destination against the same HTTPS and trusted-host policy.
- Ensure authorization headers are never forwarded to a different origin.
-
Protect sensitive medical data
- Require or enforce de-identification before transmission.
- Minimize request payloads to the information required by the model.
- Document the external processing boundary and obtain appropriate organizational approval for transmitting medical or insurance data.
-
Limit credential impact
- Use narrowly scoped, short-lived credentials.
- Rotate any keys previously supplied through command-line arguments or sent to untrusted endpoints.
- Add usage monitoring, rate limits, and alerts for unusual destinations or API consumption.
-
Add validation tests
- Verify that HTTP URLs, unapproved hosts, cross-origin redirects, and URLs containing credentials are rejected.
- Verify that secrets are not present in process arguments, application logs, ...[truncated 40 chars]
-