T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/ai_hive_mcp.py:19- Finding
Credential Exfiltration Through an Unrestricted MCP Endpoint Override
- Content
View full analysis
dict: request = urllib.request.Request(url, headers={"accept": "application/json"}) with urllib.request.urlopen(request, timeout=20) as response: return json.loads(response.read().decode("utf-8")) def parse_payload(raw: bytes, content_type: str) -> dict: text = raw.decode("utf-8", errors="replace").strip() if "text/event-stream" in content_type or text.startswith("event:") or text.startswith("data:"): for line in text.splitlines(): if line.startswith("data:"): candidate = line[5:].strip() if candidate and candidate != "[DONE]": return json.loads(candidate) raise RuntimeError("MCP returned SSE without a parseable data event.") if not text: return {} return json.loads(text) def auth_headers() -> dict[str, str]: key = os.environ.get("AI_HIVE_API_KEY", "").strip() token = os.environ.get("AI_HIVE_ACCESS_TOKEN", "").strip() if token: return {"authorization": f"Bearer {token}"} if key: return {"x-ai-hive-api-key": key} raise SystemExit( "Missing credentials. OAuth users should authenticate through their MCP client; " "this script requires AI_HIVE_API_KEY for tool calls, or doctor may be run without credentials." ) def post(payload: dict, session_id: str | None = None) -> tuple[dic ...[truncated 3200 chars]- Remediation
View remediation