T09 · Insecure Skill Coding Practices
Error
- Location
scripts/skill.py:238- Finding
LAS API Key Can Be Transmitted to an Arbitrary Custom Endpoint
- Content
View full analysis
Dict[str, str]: return { "Content-Type": "application/json", "Authorization": f"Bearer {get_api_key()}", } ``` ```python def get_api_base(*, cli_api_base: Optional[str] = None, region: str = DEFAULT_REGION) -> str: if cli_api_base: return cli_api_base.rstrip("/") env_api_base = os.environ.get("LAS_API_BASE") if env_api_base: return env_api_base.rstrip("/") ``` ```python for attempt in range(1, max_attempts + 1): try: r = requests.post(url, headers=_headers(), json=payload, timeout=timeout_s) ``` ### Technical Analysis The `--api-base` command-line option and `LAS_API_BASE` environment variable accept an arbitrary URL. The value is not restricted to HTTPS, validated against an allowlist, or checked to ensure that it belongs to an official LAS domain. Every request made through `_post_json_with_retry()` receives the authorization header generated by `_headers()`. Consequently, a custom endpoint receives the user's complete `LAS_API_KEY` as a bearer credential. The environment-loading behavior increases the practical exposure because the program automatically reads `env.sh` from the Skill directory or current working directory. A malicious or unintentionally modified configuration file can therefore redirect authenticated traffic without requiring changes to the Python source. The same issue applies to redirects: the code does not explicitly disable redirects or validate their destinations. Credential handling across redirects consequently depends on the HTTP library's behavior rather than an explicit security policy. ### Attack Path 1. An attacker causes `LAS_API_BASE` to be set to an attacker-co ...[truncated 1093 chars]- Remediation
View remediation