T09 · Insecure Skill Coding Practices
Error
- Location
skill.py:99- Finding
Wallet Access Token Exposure Through Request URLs and Application Logs
- Content
View full analysis
Dict[str, Any]: """Send an HTTP request.""" url = f"{self.base_url}{endpoint}" headers = { "Content-Type": "application/json", "Accept": "application/json" } try: response = requests.request( method=method, url=url, headers=headers, timeout=30, **kwargs ) response.raise_for_status() return response.json() except requests.exceptions.RequestException as e: logger.error(f"Request failed: {url}, error: {str(e)}") raise Exception(f"API request failed: {str(e)}") ``` The relevant balance lookup constructs the endpoint as follows: ```python def get_balance(self, access_token: str) -> Dict[str, Any]: endpoint = f"/api/v1/claw_pay/balance/{access_token}" logger.info(f"Querying balance: access_token={access_token[:10]}...") try: result = self._make_request("GET", endpoint) logger.info( f"Balance query succeeded: " f"claw_name={result.get('claw_name')}, " f"balance={result.get('balance')}" ) return result except Exception as e: logger.error(f"Balance query failed: {str(e)}") raise ``` The displayed English log messages are faithful translations of the source literals; the execution behavior and interpolated values are unchanged. ### Technical Analysis The balance API places `access_token`, a wallet credential, directly in the URL path. Sensitive credentials should not be transported in URL paths or query strings because URLs are routinely retained by: - Application and framework logs - Reverse-proxy access logs - API gateways and loa ...[truncated 1927 chars]- Remediation
View remediation