T09 · Insecure Skill Coding Practices
Error
- Location
scripts/ai_hive_mcp.py:19- Finding
Authentication Credentials Can Be Sent to an Arbitrary MCP Endpoint
- Content
View full analysis
dict[str, str]: key = os.environ.get("AI_HIVE_API_KEY", "").strip() token = os.environ.get("AI_HIVE_ACCESS_TOKEN", "").strip() if token: return {"authorization": f"Bearer {token}"} if key: return {"x-ai-hive-api-key": key} raise SystemExit( "缺少凭据。OAuth 用户请在 MCP 客户端中完成登录；本脚本调用工具时需通过环境变量提供 " "AI_HIVE_API_KEY，或仅运行 doctor。" ) def post(payload: dict, session_id: str | None = None) -> tuple[dict, str | None]: headers = { "content-type": "application/json", "accept": "application/json, text/event-stream", **auth_headers(), } if session_id: headers["mcp-session-id"] = session_id request = urllib.request.Request( MCP_URL, data=json.dumps(payload, ensure_ascii=False).encode("utf-8"), headers=headers, method="POST", ) ``` ### Technical Analysis The MCP destination is taken directly from the `AI_HIVE_MCP_URL` environment variable. The value is not validated before `post()` attaches an AI-HIVE API key or OAuth bearer token and sends the request. There is no enforcement of: - HTTPS transport. - The expected `ai-hive.iclip.cn` hostname. - The expected `/api/mcp` path. - A safe port. - An approved endpoint allowlist. Consequently, a process launcher, wrapper script, compromised execution environment, or configuration mechanism that can set `AI_HIVE_MCP_URL` can direct authenticated requests to an attacker-controlled server. The transmitted request may include both the credential and user-supplied MCP tool arguments. This network behavior is necessary for the declared remote-generation functionality, ...[truncated 1639 chars]- Remediation
View remediation