T09 · Insecure Skill Coding Practices
- Location
scripts/ai_hive_mcp.py:16- Finding
Credential Exfiltration Through a User-Controlled MCP Endpoint
- Content
View full analysis
Vulnerability Details
File Location:
scripts/ai_hive_mcp.py, lines 16 and 52–70
Vulnerability Type: Credential disclosure through an unrestricted network endpoint override
Risk Level: Highpython MCP_URL = os.environ.get("AI_HIVE_MCP_URL", "https://ai-hive.iclip.cn/api/mcp") def auth_headers() -> dict[str, str]: key = os.environ.get("AI_HIVE_API_KEY", "").strip() token = os.environ.get("AI_HIVE_ACCESS_TOKEN", "").strip() if token: return {"authorization": f"Bearer {token}"} if key: return {"x-ai-hive-api-key": key} raise SystemExit( "缺少凭据。OAuth 用户请在 MCP 客户端中完成登录；本脚本调用工具时需通过环境变量提供 " "AI_HIVE_API_KEY，或仅运行 doctor。" ) def post(payload: dict, session_id: str | None = None) -> tuple[dict, str | None]: headers = { "content-type": "application/json", "accept": "application/json, text/event-stream", **auth_headers(), } if session_id: headers["mcp-session-id"] = session_id request = urllib.request.Request( MCP_URL, data=json.dumps(payload, ensure_ascii=False).encode("utf-8"), headers=headers, method="POST", )Technical Analysis
The MCP destination is read from the
AI_HIVE_MCP_URLenvironment variable without validation. The same request path unconditionally adds either theAI_HIVE_ACCESS_TOKENbearer token or theAI_HIVE_API_KEYheader before sending the request.Consequently, a process environment that sets
AI_HIVE_MCP_URLcan redirect authenticated requests to an arbitrary destination, including a non-HTTPS URL or an attacker-controlled HTTPS server. No scheme restriction, hostname allowlist, origin binding, or explicit custom-endpoint confirmation is applied.The default destination,
https://ai-hive.iclip.cn/api/mcp, is consistent with the Skill's declared remote AI-HIVE functionality, and transmitting credentials to that approved service is necessary for authenticated operations. Howe ...[truncated 1829 chars]- Remediation
View remediation
Remediation Suggestions
-
Remove the endpoint override for production use. Assign the MCP URL to the fixed, documented AI-HIVE endpoint:
python MCP_URL = "https://ai-hive.iclip.cn/api/mcp" -
If custom endpoints are operationally required, enforce an explicit allowlist. Parse the URL and require:
- Scheme:
https - Hostname:
ai-hive.iclip.cn - Port: default HTTPS port
- Path:
/api/mcp - No embedded username or password
- Scheme:
-
Bind credentials to the approved origin. Add authentication headers only after confirming that the final request destination is the trusted AI-HIVE origin.
-
Prevent cross-origin credential forwarding. Disable redirects for authenticated requests or validate every redirect target before following it. Reject redirects to a different scheme, hostname, or port.
-
Separate custom-endpoint diagnostics from authenticated operation. If arbitrary MCP endpoints must be testable, do not attach AI-HIVE credentials to them. Require a separate credential explicitly scoped to the custom endpoint.
-
Require deliberate opt-in for exceptional configurations. A custom endpoint should require an explicit command-line option and an interactive warning rather than being silently accepted from the ambient environment.
-
Harden incident response guidance. If an untrusted endpoint may have received a credential, immediately revoke or rotate the API key, revoke the OAuth authorization where applicable, and review account task and billing activity.
-