T09 · Insecure Skill Coding Practices
Error
- Location
- scripts/web_search.py:49
- Finding
- API Key Is Transmitted to an Undocumented Non-Volcengine Domain<![CDATA[ ## Vulnerability Details **File Location**: `scripts/web_search.py:49, 311-324` **Vulnerability Type**: Credential disclosure to an insufficiently documented network destination **Risk Level**: High ### Complete Code Snippet ```python HOST = "mercury.volcengineapi.com" INTERNAL_API_URL = "https://open.feedcoopapi.com/search_api/web_search" ``` ```python body_str = json.dumps(body, ensure_ascii=False) if api_key: headers = { "Content-Type": "application/json", TRAFFIC_TAG_HEADER: TRAFFIC_TAG_VALUE, "Authorization": f"Bearer {api_key}", } url = INTERNAL_API_URL else: if not ak or not sk: raise ValueError("missing volcengine credentials") headers = _sign_request("POST", ak, sk, body_str, session_token) url = f"https://{HOST}?Action={ACTION}&Version={VERSION}" response = requests.post( url, headers=headers, data=body_str.encode("utf-8"), timeout=30, ) ``` ### Technical Analysis When API-key authentication is selected, the script places the complete secret in a bearer `Authorization` header and sends it to `open.feedcoopapi.com`. This destination differs from the documented Volcengine API host used by the AK/SK path, `mercury.volcengineapi.com`. The project documentation repeatedly describes this as an official Volcengine search capability and directs users to obtain credentials from Volcengine, but it does not disclose or explain why those credentials are delivered to `open.feedcoopapi.com`. No certificate pinning, endpoint allowlist configurable by an administrator, audience-restricted token exchange, or destination validation is implemented. Sending an API key to the service that authenticates it may be functionally necessary. However, sending it to a materially different and undocumented domain exceeds what users can reasonably infer from the declared functionality unless ownership, processing purpose, and authorization for that domain are established. The AK/SK branch fo ...[truncated 1731 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Send credentials only to an endpoint explicitly listed in the official product documentation. 2. If `open.feedcoopapi.com` is an authorized Volcengine endpoint, document its ownership, purpose, privacy implications, and credential-processing role prominently before credential collection. 3. Prefer the signed request flow, where the secret key remains local, or exchange the API key for a short-lived, narrowly scoped token through an official endpoint. 4. Restrict tokens to the Web Search action, enforce short expiration, and provide straightforward revocation and rotation. 5. Add an administrator-configurable endpoint allowlist and fail closed if the configured hostname is not approved. 6. Avoid following redirects for authenticated requests, or explicitly validate every redirect destination before retaining the `Authorization` header. 7. Add automated tests asserting that credentials can only be sent to approved hosts. 8. Notify existing users of the destination and recommend credential rotation if the domain was not previously disclosed. ]]>