T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/ai_hive_mcp.py:19- Finding
Credentials Can Be Transmitted to an Arbitrary MCP Endpoint
- Content
View full analysis
dict[str, str]: key = os.environ.get("AI_HIVE_API_KEY", "").strip() token = os.environ.get("AI_HIVE_ACCESS_TOKEN", "").strip() if token: return {"authorization": f"Bearer {token}"} if key: return {"x-ai-hive-api-key": key} raise SystemExit( "缺少凭据。OAuth 用户请在 MCP 客户端中完成登录；本脚本调用工具时需通过环境变量提供 " "AI_HIVE_API_KEY，或仅运行 doctor。" ) def post(payload: dict, session_id: str | None = None) -> tuple[dict, str | None]: headers = { "content-type": "application/json", "accept": "application/json, text/event-stream", **auth_headers(), } if session_id: headers["mcp-session-id"] = session_id request = urllib.request.Request( MCP_URL, data=json.dumps(payload, ensure_ascii=False).encode("utf-8"), headers=headers, method="POST", ) try: with urllib.request.urlopen(request, timeout=60) as response: result = parse_payload(response.read(), response.headers.get("content-type", "")) return result, response.headers.get("mcp-session-id") or session_id except urllib.error.HTTPError as error: body = error.read().decode("utf-8", errors="replace") if error.code == 401: raise SystemExit( "AI-HIVE MCP 返回 401。请确认 API Key 完整且未撤销；OAuth 用户应在客户端内重新连接，" "不要把 OAuth token 粘贴到命令行。" ) raise SystemExit(f"AI-HIVE MCP HTTP {error.code}: {body[:800]}") ``` ### Technical Analysis The MCP destination is read from the externally controlled `AI_HIVE_MCP_URL` environment variable. The code does not validate the URL scheme, hostna ...[truncated 2761 chars]- Remediation
View remediation
str: parsed = urlparse(raw_url) if ( parsed.scheme != "https" or parsed.hostname not in ALLOWED_MCP_HOSTS or parsed.port not in (None, 443) or parsed.path not in ALLOWED_MCP_PATHS or parsed.username is not None or parsed.password is not None ): raise SystemExit("Refusing to send credentials to an unapproved MCP endpoint.") return raw_url ``` 3. **Separate endpoint selection from credential attachment.** Construct authentication headers only after destination validation. Unapproved destinations should receive no API key, bearer token, or session identifier. 4. **Prevent cross-origin credential forwarding.** Disable automatic redirects for authenticated requests or validate every redirect target against the same scheme, hostname, port, and path policy before following it. 5. **Apply least-privilege credential controls.** Prefer narrowly scoped, short-lived OAuth tokens where supported. Use account-side spending limits and revoke credentials immediately if an untrusted endpoint may have received them. 6. **Avoid unnecessary token support.** The documentation primarily directs OAuth users to a dedicated MCP client. If direct bearer-token use by this script is not required, remove `AI_HIVE_ACCESS_TOKEN` support to reduce the types of credentials exposed to this path. 7. **Add automated security tests.** Test ...[truncated 237 chars]