T09 · Insecure Skill Coding Practices
Error
- Location
scripts/mcp_gateway_client.py:75- Finding
Arbitrary Gateway URL Enables Cloud Credential Disclosure
- Content
View full analysis
- Remediation
View remediation
str: parsed = urlparse(url) if parsed.scheme != "https": raise ValueError("The MCP gateway must use HTTPS") if parsed.hostname not in ALLOWED_GATEWAY_HOSTS: raise ValueError("Unapproved MCP gateway hostname") if parsed.username or parsed.password: raise ValueError("Gateway URLs must not contain user information") return url ``` 3. **Validate the endpoint before calling `load_credentials()`.** This prevents credentials from entering a request flow involving an untrusted destination. 4. **Disable redirects or validate every redirect target.** For a fixed API gateway, use: ```python response = requests.post( validated_url, headers=headers, json=payload, timeout=timeout_seconds, allow_redirects=False, ) ``` 5. **Do not transmit the secret key as a reusable raw header if the service supports signed requests.** Prefer Volcengine's official request-signing mechanism so the secret key remains local and only a time-limited request signature is transmitted. 6. **Reject plaintext transport unconditionally.** Only permit HTTPS with normal certificate verification enabled. 7. **Avoid command-line credential arguments.** Values passed through `--access-key` and `--secret-key` may be exposed through shell history or process listings. Prefer protected environment injection, an OS credential store, or the official cloud SDK credent ...[truncated 490 chars]