T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/rwlib/endpoint.py:481- Finding
Repository-Controlled Configuration Can Redirect Document Passages and Model Credentials
- Content
View full analysis
Vulnerability Details
File Location:
scripts/rwlib/endpoint.py:481-520andscripts/rwlib/endpoint.py:278-289
Vulnerability Type: Untrusted endpoint configuration and sensitive-data disclosure
Risk Level: MediumComplete Code Snippet
python def _request(self, system, user, temperature, opener, thinking_off): payload = { "model": self.model, "messages": [{"role": "system", "content": system}, {"role": "user", "content": user}], "temperature": (self.temperature if temperature is None else float(temperature)), "max_tokens": self.max_output_tokens, "stream": False, } if thinking_off: payload.update(THINKING_OFF) body = json.dumps(payload).encode("utf-8") headers = {"Content-Type": "application/json"} if self.api_key: headers["Authorization"] = "Bearer %s" % self.api_key url = self.base_url + "/chat/completions" request = urllib.request.Request(url, data=body, headers=headers, method="POST") opener = opener or urllib.request.urlopen try: with opener(request, timeout=self.timeout) as response: raw = response.read().decode("utf-8", "replace")python start_dirs = [] if target_path: start_dirs.append(os.path.dirname(os.path.abspath(target_path))) start_dirs.append(os.getcwd()) path = next((p for p in (_find_config(d) for d in start_dirs) if p), None) if path: try: with open(path, encoding="utf-8") as fh: config = json.load(fh) except (OSError, ValueError) as exc: return None, "%s could not be read: %s" % (path, exc) bad = problems(config, path) if bad: return None, " ".join(bad) env_name = config.pop("api_key_env", None) key = os.environ.get(env_name) if env_name else None if env_na ...[truncated 3585 chars]- Remediation
View remediation
Remediation Suggestions
- Treat every
.rabbit-modelfile located inside a Git working tree as untrusted by default. - Refuse repository-controlled remote endpoints unless the user supplies an explicit flag such as
--trust-repository-model-config. - Require interactive confirmation before the first transmission, showing the normalized destination host, configuration source, credential variable name, and passage count.
- Prefer user-owned configuration outside the repository. Environment or command-line endpoint settings should override repository files rather than the reverse.
- Maintain a user-level allowlist of approved endpoint origins and require exact scheme, hostname, and port matching.
- Do not attach credentials selected by repository configuration. Require credential selection to come from a trusted user-level configuration or an explicit command-line option.
- Consider refusing
api_key_enventirely in repository-local files, even when the name begins withRABBIT_. - Make
--model-planor an equivalent no-send preview mandatory before using a repository-controlled endpoint. - Clearly distinguish local loopback endpoints from remote endpoints and require an additional opt-in for any non-loopback destination.
- Add regression tests proving that configuration inside a Git checkout cannot silently override a trusted endpoint or cause a credential-bearing request without explicit approval.
- Treat every