T09 · Insecure Skill Coding Practices
Warning
- Location
- scripts/run.py:77
- Finding
- Caller-Controlled API Endpoint Can Exfiltrate Credentials and Medical Prompt Data## Vulnerability Details **File Location**: `scripts/run.py`, lines 77–92; endpoint control is exposed at line 208 **Vulnerability Type**: Unrestricted transmission of credentials and sensitive data to a caller-controlled endpoint **Risk Level**: Medium ### Vulnerable Code ```python try: req = Request( api_url, data=json.dumps(payload, ensure_ascii=False).encode("utf-8"), headers={ "Content-Type": "application/json", "Authorization": f"Bearer {appkey}", }, ) resp = urlopen(req, timeout=timeout) body = json.loads(resp.read().decode("utf-8")) except HTTPError as exc: detail = exc.read().decode("utf-8", errors="replace")[:2000] raise RuntimeError(f"API HTTP {exc.code}: {detail}") from exc ``` The destination is directly configurable through the command line: ```python p.add_argument("--api-url", default=DEFAULT_API_URL, help="OpenAI compatible API endpoint") ``` The selected endpoint, credential, and medical prompt are then passed to the request function: ```python out["answer"] = call_llm( api_url=args.api_url, model=args.model, appkey=args.appkey, system_prompt=args.system_prompt, user_prompt=user_prompt, temperature=float(args.temperature), timeout=int(args.timeout), ) ``` ### Technical Analysis The `--api-url` argument is accepted without validating its scheme, hostname, port, or trust relationship. `call_llm()` sends the supplied application key in an `Authorization: Bearer` header and includes the complete user question in the HTTP request body. Consequently, an untrusted wrapper, automation configuration, or command invocation can redirect both values to an attacker-controlled server. The implementation also accepts plaintext `http://` destinations, which can expose the authorization header and medical prompt to network interception. Redirect behavior is not explicit ...[truncated 1870 chars]
- Remediation
- ## Remediation Suggestions 1. Remove runtime endpoint override support unless it is operationally necessary. 2. If custom endpoints are required, parse the URL and enforce: - The `https` scheme. - An explicit allowlist of trusted hostnames. - Expected ports only. - Rejection of embedded credentials, fragments, and malformed hosts. 3. Prevent authorization headers from being forwarded when a redirect changes the scheme, hostname, or port. Prefer disabling redirects or validating every redirect target against the same allowlist. 4. Use separate, least-privileged credentials for each approved service rather than forwarding one key to arbitrary destinations. 5. Require an explicit administrative configuration or clearly marked unsafe mode before allowing a non-default endpoint; do not permit ordinary question input to control it. 6. Validate that TLS certificate verification remains enabled and reject plaintext HTTP endpoints. 7. Continue requiring patient data to be de-identified, and add clear runtime or deployment safeguards preventing sensitive records from being sent to unapproved services. 8. Add automated tests confirming that HTTP URLs, unapproved hosts, deceptive subdomains, alternate ports, and cross-origin redirects are rejected before any credential-bearing request is sent.