T09 · Insecure Skill Coding Practices
- Location
scripts/ai_hive_mcp.py:17- Finding
Environment-Controlled MCP Endpoint Can Exfiltrate API Credentials
- Content
View full analysis
Vulnerability Details
File Location:
scripts/ai_hive_mcp.py, lines 17 and 44–70
Vulnerability Type: Unvalidated credential destination
Risk Level: MediumVulnerable Code
python MCP_URL = os.environ.get("AI_HIVE_MCP_URL", "https://ai-hive.iclip.cn/api/mcp")python def auth_headers() -> dict[str, str]: key = os.environ.get("AI_HIVE_API_KEY", "").strip() token = os.environ.get("AI_HIVE_ACCESS_TOKEN", "").strip() if token: return {"authorization": f"Bearer {token}"} if key: return {"x-ai-hive-api-key": key} raise SystemExit( "缺少凭据。OAuth 用户请在 MCP 客户端中完成登录；本脚本调用工具时需通过环境变量提供 " "AI_HIVE_API_KEY，或仅运行 doctor。" ) def post(payload: dict, session_id: str | None = None) -> tuple[dict, str | None]: headers = { "content-type": "application/json", "accept": "application/json, text/event-stream", **auth_headers(), } if session_id: headers["mcp-session-id"] = session_id request = urllib.request.Request( MCP_URL, data=json.dumps(payload, ensure_ascii=False).encode("utf-8"), headers=headers, method="POST", )Technical Analysis
The script obtains the MCP destination from the
AI_HIVE_MCP_URLenvironment variable while independently obtaining an API key or OAuth access token from other environment variables. Every call made throughpost()automatically attaches that credential to the configured destination.No validation ensures that the destination:
- Uses HTTPS.
- Belongs to the documented
ai-hive.iclip.cnhost. - Uses the expected
/api/mcppath. - Was explicitly approved before receiving the credential.
Endpoint configurability may be useful for testing, but coupling an unrestricted endpoint override with automatic credential forwarding violates least-privilege credential handling. The declared production functionality only requires sending AI-HIVE credentials to the documented AI-HIVE se ...[truncated 1498 chars]
- Remediation
View remediation
Remediation Suggestions
-
Pin credential-bearing requests to the trusted production endpoint
python MCP_URL = "https://ai-hive.iclip.cn/api/mcp" -
If custom endpoints are required, enforce a strict allowlist
- Parse the URL with
urllib.parse.urlparse. - Require the
httpsscheme. - Require the exact expected hostname and port.
- Require the expected MCP path.
- Reject embedded usernames, passwords, fragments, and unexpected query parameters.
- Parse the URL with
-
Do not reuse production credentials for custom endpoints
- Introduce separate environment variables for development endpoints and development credentials.
- Refuse to attach
AI_HIVE_API_KEYorAI_HIVE_ACCESS_TOKENwhen the destination is not the production host.
-
Require explicit authorization for endpoint overrides
- Use a command-line option such as
--allow-custom-endpoint. - Display the destination hostname and require confirmation before transmitting any credential.
- Fail closed in non-interactive environments unless an explicit secure override is provided.
- Use a command-line option such as
-
Apply redirect restrictions
- Ensure credential-bearing requests cannot be redirected to an untrusted host.
- Revalidate the scheme and hostname for every redirect target before forwarding authentication headers.
-
Use scoped and revocable credentials
- Prefer narrowly scoped OAuth tokens over broadly privileged API keys.
- Avoid granting generation or billing capabilities when only model listing is needed.
- Rotate and revoke credentials immediately if endpoint manipulation or leakage is suspected.
-
Add automated security tests
- Verify that HTTP destinations are rejected.
- Verify that foreign hostnames are rejected.
- Verify that credentials are never attached to custom or redirected destinations.
-