T09 · Insecure Skill Coding Practices
- Location
lib/api_client.py:31- Finding
Unnecessary API Key Disclosure on Public Analytics Requests
- Content
View full analysis
Vulnerability Details
File Location:
lib/api_client.py:31-38
Vulnerability Type: Unnecessary transmission of sensitive authentication material
Risk Level: MediumVulnerable Code
python # Public API requires authentication — sign with PTK key if available config = _load_config() if config.get("api_key") and config.get("api_secret"): path = f"/api/public{endpoint}" auth_headers = _sign(config["api_secret"], "GET", path) req.add_header("X-PTK-Key", config["api_key"]) for k, v in auth_headers.items(): req.add_header(k, v)Technical Analysis
The public analytics request function automatically loads trading credentials and sends the API key, timestamp, and HMAC signature to
https://api.prob.tradewhenever credentials are configured.This behavior conflicts with
README.md:99, which identifies the Public Analytics API as requiring no authentication, and withscripts/probtrade.py:5, which describes analytics commands as unauthenticated. On the available evidence, attaching trading authentication material to public analytics requests is unnecessary and violates least-data and least-privilege principles.The API secret itself is not transmitted: it is used locally to calculate an HMAC-SHA256 signature. HTTPS also protects the request in transit under normal certificate validation. Nevertheless, the API key and derived authentication metadata become available to the remote analytics service and potentially its request logs, proxies, monitoring systems, and compromised server-side components.
Attack Path
- A user configures
PROBTRADE_API_KEYandPROBTRADE_API_SECRET, or stores them in the supported configuration file. - The user invokes an analytics-only command such as
overview,hot,search, orstats. fetch()calls_load_config()despite the endpoint being documented as public.- The function places the API key in the
X-PTK-Keyhead ...[truncated 1237 chars]
- A user configures
- Remediation
View remediation
Remediation Suggestions
- Remove credential loading and authentication headers from
fetch()when accessing documented public analytics endpoints. - Restrict
_load_config(), HMAC signing, andX-PTK-Keytransmission totrading_request(). - If analytics authentication is actually required, update all conflicting documentation and use a separate read-only analytics credential with no trading permissions.
- Implement explicit endpoint-level authentication policy rather than opportunistically attaching credentials whenever they are present.
- Ensure server-side request logs redact
X-PTK-Key,X-PTK-Signature, and related authentication headers. - Enforce short timestamp tolerances and replay detection for signed requests.
- Scope keys to the minimum required operations and support immediate rotation and revocation.
- Add automated tests confirming that public analytics requests never contain authentication headers.
- Remove credential loading and authentication headers from