T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/ai_hive_mcp.py:19- Finding
Credentials Can Be Transmitted to an Arbitrary User-Configured MCP Endpoint
- Content
View full analysis
dict[str, str]: key = os.environ.get("AI_HIVE_API_KEY", "").strip() token = os.environ.get("AI_HIVE_ACCESS_TOKEN", "").strip() if token: return {"authorization": f"Bearer {token}"} if key: return {"x-ai-hive-api-key": key} raise SystemExit( "缺少凭据。OAuth 用户请在 MCP 客户端中完成登录；本脚本调用工具时需通过环境变量提供 " "AI_HIVE_API_KEY，或仅运行 doctor。" ) def post(payload: dict, session_id: str | None = None) -> tuple[dict, str | None]: headers = { "content-type": "application/json", "accept": "application/json, text/event-stream", **auth_headers(), } if session_id: headers["mcp-session-id"] = session_id request = urllib.request.Request( MCP_URL, data=json.dumps(payload, ensure_ascii=False).encode("utf-8"), headers=headers, method="POST", ) ``` ### Technical Analysis The script permits `AI_HIVE_MCP_URL` to replace the documented AI-HIVE endpoint with an arbitrary URL. Before sending a request, `auth_headers()` reads either `AI_HIVE_ACCESS_TOKEN` or `AI_HIVE_API_KEY` from the process environment and adds the credential to the request headers. No validation ensures that the configured URL: - Uses HTTPS. - Resolves to the documented `ai-hive.iclip.cn` host. - Uses the expected `/api/mcp` path. - Remains on an approved origin throughout request processing. As a result, a modified environment, compromised launcher, unsafe shell profile, or copied configuration can cause the script to transmit the credential directly to an attacker-controlled endpoint. This network transmission is necessary when communicating with the legitimate A ...[truncated 1943 chars]- Remediation
View remediation
str: parsed = urlparse(raw_url) if parsed.scheme != "https": raise SystemExit("The MCP endpoint must use HTTPS.") if parsed.hostname not in ALLOWED_MCP_HOSTS: raise SystemExit("The MCP endpoint host is not approved.") if parsed.port not in (None, 443): raise SystemExit("The MCP endpoint must use the standard HTTPS port.") if parsed.path != "/api/mcp" or parsed.params or parsed.query or parsed.fragment: raise SystemExit("The MCP endpoint path is invalid.") if parsed.username or parsed.password: raise SystemExit("User information is not permitted in the MCP URL.") return raw_url ``` 3. **Validate the destination before calling `auth_headers()`.** Authentication material should only be loaded and attached after the endpoint passes all origin checks. 4. **Restrict redirects for authenticated requests.** Reject redirects to a different scheme, host, port, or path, and never forward authentication headers across origins. 5. **Prefer scoped, short-lived credentials.** Use OAuth tokens with the minimum required MCP scopes instead of broadly privileged, long-lived API keys where possible. 6. **Document the trust boundary.** Warn that endpoint overrides must not be accepted from untrusted project files, shell snippets, task inputs, or user-provided prompts. 7. **Add automated tests** confirming that HTTP endpoints, alternate hosts, embedded credenti ...[truncated 101 chars]