T09 · Insecure Skill Coding Practices
Error
- Location
scripts/account.js:12- Finding
API Key Disclosure Through an Unrestricted Base URL Override
- Content
View full analysis
controller.abort(), 30000); try { const res = await fetch(url, { method, headers, signal: controller.signal, }); ``` ```js async function queryBalance(apiKey) { const res = await httpJson("GET", `${BASE_URL}/v1/generation/balance`, apiKey); ``` The documentation explicitly exposes the override without enforcing its security requirements: ```md - Optional override `WERYAI_BASE_URL` defaults to `https://api.weryai.com`. Only override it with a trusted host. ``` The vendored client implements the same unrestricted credential transmission pattern: ```js export function createClient(ctx) { const { apiKey, baseUrl, requestTimeoutMs, verbose } = ctx; async function request(method, path, body = null, { retries = 0 } = {}) { if (!apiKey) { throw Object.assign( new Error('Missing API key environment variable.'), { code: 'NO_API_KEY' }, ); } const url = `${baseUrl}${path}`; const headers = { Authorization: `Bearer ${apiKey}`, 'Content-Type': 'application/json', }; ``` ### Technical Analysis The balance operation legitimately needs to send `WERYAI_API_KEY` to the official WeryAI API. However, `WERYAI_BASE_URL` is accepted witho ...[truncated 2400 chars]- Remediation
View remediation