T09 · Insecure Skill Coding Practices
Error
- Location
scripts/minimax_tts.py:104- Finding
MiniMax API Credential Disclosure Through Unrestricted Endpoint Overrides
- Content
View full analysis
None: api_key = ensure_api_key() headers = { "Authorization": f"Bearer {api_key}", "Content-Type": "application/json", } ``` ```python response = requests.post( args.endpoint, headers=headers, json=payload, timeout=args.timeout, ) ``` ```python def run_voices(args: argparse.Namespace) -> None: api_key = ensure_api_key() headers = { "Authorization": f"Bearer {api_key}", "Content-Type": "application/json", } payload = {"voice_type": args.voice_type} try: response = requests.post( args.endpoint, headers=headers, json=payload, timeout=args.timeout, ) ``` ```python tts_parser.add_argument( "--endpoint", default="https://api.minimax.io/v1/t2a_v2", help="Override MiniMax T2A endpoint", ) ``` ```python voices_parser.add_argument( "--endpoint", default="https://api.minimax.io/v1/get_voice", help="Override the catalog endpoint", ) ``` ### Technical Analysis Both CLI subcommands accept an unrestricted `--endpoint` argument. The script then attaches the value of `MINIMAX_API_KEY` as an HTTP bearer token to a request sent to that destination. Sending the credential to the default official MiniMax endpoints is necessary for the declared functionality. Allowing any caller-controlled host to receive the same credential is not necessary and violates least-privilege network handling. The code does not enforce HTTPS, validate the hostname, constrain the URL path, or require confirmation before sending the credential to a non-default destination. Consequently, an untrusted command, copied usage instruction, or ac ...[truncated 1369 chars]- Remediation
View remediation