T09 · Insecure Skill Coding Practices
Error
- Location
- scripts/run.py:75
- Finding
- Caller-Controlled API Endpoint Exposes Credentials and Medical Input## Vulnerability Details **File Location**: `scripts/run.py:75-83, 205, 258-266` **Vulnerability Type**: Unrestricted transmission of credentials and sensitive input to a caller-controlled endpoint **Risk Level**: High ### Vulnerable Code ```python req = Request( api_url, data=json.dumps(payload, ensure_ascii=False).encode("utf-8"), headers={ "Content-Type": "application/json", "Authorization": f"Bearer {appkey}", }, ) resp = urlopen(req, timeout=timeout) ``` ```python p.add_argument("--api-url", default=DEFAULT_API_URL, help="OpenAI compatible endpoint URL") ``` ```python out["answer"] = call_llm( api_url=args.api_url, model=args.model, appkey=args.appkey, system_prompt=args.system_prompt, user_prompt=user_prompt, temperature=float(args.temperature), timeout=int(args.timeout), ) ``` ### Technical Analysis The `--api-url` argument is entirely caller-controlled and is passed directly to `urllib.request.Request`. The program does not require HTTPS, validate the destination hostname against an allowlist, or prevent redirects to an untrusted destination. Every request sends the supplied application key in the `Authorization: Bearer` header. Its JSON body also includes the system prompt and user-provided question. Because the Skill processes medical questions and may receive real patient information, this body can contain sensitive medical or personal data. Consequently, anyone who can influence the command-line arguments can direct the credential and question to an attacker-operated endpoint. A plain HTTP URL can additionally expose this information to network interception. The standard-library HTTP client may follow redirects, further weakening the assumption that the credential is sent only to the intended API. ### Attack Path 1. The attacker creates an HTTP service that records request headers and bodies. 2. The attacker supplies or recommends a command using an endpoint such as: ```bash ...[truncated 1391 chars]
- Remediation
- ## Remediation Suggestions 1. **Restrict the destination** - Use a strict allowlist of approved HTTPS hostnames. - Prefer removing `--api-url` in production if endpoint customization is unnecessary. - Parse the URL and reject unsupported schemes, embedded credentials, unexpected ports, and unapproved hosts. 2. **Enforce secure transport** - Reject all non-HTTPS URLs. - Retain normal TLS certificate and hostname verification. - Consider certificate pinning where operationally appropriate. 3. **Control redirects** - Disable automatic redirects for authenticated requests or validate every redirect target against the same scheme and hostname allowlist. - Never forward the `Authorization` header across an origin change. 4. **Separate credentials by endpoint** - Do not send the default provider credential to a custom host. - Require a separate, explicitly supplied credential for approved custom endpoints. 5. **Protect medical data** - Warn users before transmitting content to a non-default service. - Add input redaction or de-identification controls for patient-related information. - Record destination approval without logging credentials or complete sensitive prompts. 6. **Validate configuration before processing** - Reject unsafe endpoint configuration before reading sensitive input or constructing the authenticated request. - Add tests covering HTTP URLs, unapproved hosts, redirects, user-info components, and unusual ports.