T09 · Insecure Skill Coding Practices
- Location
scripts/video_generate.py:11- Finding
Configurable API Endpoint Can Exfiltrate Bearer Credentials
- Content
View full analysis
Vulnerability Details
File Location:
scripts/video_generate.py, lines 11–18, 52–55, and 166–181
Vulnerability Type: Unvalidated authentication endpoint configuration
Risk Level: HighVulnerable Code
python API_KEY = ( os.getenv("ARK_API_KEY") or os.getenv("MODEL_VIDEO_API_KEY") or os.getenv("MODEL_AGENT_API_KEY") ) API_BASE = os.getenv( "MODEL_VIDEO_API_BASE", "https://ark.cn-beijing.volces.com/api/v3" ).rstrip("/")python def _get_headers() -> dict: return { "Content-Type": "application/json", "Authorization": f"Bearer {API_KEY}", }python async def _create_video_task( prompt: str, config: VideoGenerationConfig, model_name: str ) -> dict: url = f"{API_BASE}/contents/generations/tasks" body = _build_request_body(prompt, config, model_name) async with httpx.AsyncClient(timeout=60.0) as client: response = await client.post(url, headers=_get_headers(), json=body) response.raise_for_status() return response.json() async def _get_task_status(task_id: str) -> dict: url = f"{API_BASE}/contents/generations/tasks/{task_id}" async with httpx.AsyncClient(timeout=60.0) as client: response = await client.get(url, headers=_get_headers()) response.raise_for_status() return response.json()Technical Analysis
MODEL_VIDEO_API_BASEcontrols the destination of authenticated HTTP requests without validation of its scheme or hostname. Both task-creation and task-status requests attach the selected API key as a bearer token.An attacker who can influence the process environment can set this variable to an attacker-controlled endpoint. The script will then transmit the bearer credential, prompts, task identifiers, and supplied reference-media URLs to that endpoint. Accepting
MODEL_AGENT_API_KEYas a fallback increases the potential imp ...[truncated 1369 chars]- Remediation
View remediation
Remediation Suggestions
- Restrict API requests to an explicit allowlist of approved HTTPS origins, preferably the official service hostname.
- Parse the configured URL and reject non-HTTPS schemes, embedded credentials, unexpected ports, fragments, and unapproved hostnames.
- Disable automatic redirects or validate the destination of every redirect before forwarding authorization headers.
- Do not use
MODEL_AGENT_API_KEYas a fallback. Require a dedicated, least-privilege video-generation credential. - Separate credentials by service and environment, with narrowly scoped permissions and rotation support.
- Fail closed when endpoint validation fails and avoid including secrets in exception messages or logs.
- Protect deployment and environment configuration from modification by untrusted users.