T09 · Insecure Skill Coding Practices
Error
- Location
scripts/ai_hive_mcp.py:19- Finding
Credentials and tool arguments can be transmitted to an arbitrary environment-controlled endpoint
- Content
View full analysis
dict[str, str]: key = os.environ.get("AI_HIVE_API_KEY", "").strip() token = os.environ.get("AI_HIVE_ACCESS_TOKEN", "").strip() if token: return {"authorization": f"Bearer {token}"} if key: return {"x-ai-hive-api-key": key} raise SystemExit( "缺少凭据。OAuth 用户请在 MCP 客户端中完成登录；本脚本调用工具时需通过环境变量提供 " "AI_HIVE_API_KEY，或仅运行 doctor。" ) def post(payload: dict, session_id: str | None = None) -> tuple[dict, str | None]: headers = { "content-type": "application/json", "accept": "application/json, text/event-stream", **auth_headers(), } if session_id: headers["mcp-session-id"] = session_id request = urllib.request.Request( MCP_URL, data=json.dumps(payload, ensure_ascii=False).encode("utf-8"), headers=headers, method="POST", ) ``` ### Technical Analysis The remote MCP destination is taken directly from the `AI_HIVE_MCP_URL` environment variable. The code does not validate that the resulting URL: - Uses HTTPS. - Belongs to the documented `ai-hive.iclip.cn` host. - Uses an approved port. - Does not contain user information or another deceptive authority component. - Remains on the approved origin after redirects. The `post()` function then obtains either `AI_HIVE_ACCESS_TOKEN` or `AI_HIVE_API_KEY` and attaches it to every request sent to that destination. MCP payloads, including tool names and tool arguments, are transmitted in the same request. A configurable endpoint may be useful for testing, but attaching production credentials without validating the endpoint exceeds what is necessary for the declared AI-HIVE workflow ...[truncated 1387 chars]- Remediation
View remediation