T09 · Insecure Skill Coding Practices
- Location
scripts/imagegen.py:91- Finding
Stored API Key Can Be Redirected to an Untrusted Base URL
- Content
View full analysis
Vulnerability Details
File Location:
scripts/imagegen.py, lines 91–99 and 125–145
Vulnerability Type: Credential disclosure through an unrestricted API endpoint override
Risk Level: MediumVulnerable Code:
python def _resolve_base_url(self, cli_url): if cli_url: return cli_url.rstrip("/") env_url = os.environ.get("AI_HIVE_BASE_URL") if env_url: return env_url.rstrip("/") file_config = self._read_config_file() if file_config.get("base_url"): return file_config["base_url"].rstrip("/") return DEFAULT_BASE_URLpython class AiHiveClient: """Encapsulates AI Hive OpenAPI HTTP calls.""" def __init__(self, config): self.config = config self.base = config.base_url self.headers = { "Authorization": f"Bearer {config.api_key}", "Content-Type": "application/json", } def _url(self, path): return f"{self.base}/openapi/v1/{path}" def _request(self, method, url, **kwargs): self.config.log(f"{method} {url}") try: resp = requests.request( method, url, headers=self.headers, timeout=DEFAULT_TIMEOUT, **kwargs )Technical Analysis
The API key and API base URL are resolved independently. The key may be loaded from the persistent configuration file at
~/.ai-hive/config.json, while the destination can be overridden through either theAI_HIVE_BASE_URLenvironment variable or the--base-urlcommand-line argument.The client unconditionally includes the API key in the
Authorizationheader for requests sent to the selected base URL. No validation enforces HTTPS, checks that the hostname is the expected AI Hive service, or requests confirmation before reusing a stored credential with a different origin.An attacker capable of influencing the process environment or command invocat ...[truncated 1517 chars]
- Remediation
View remediation
Remediation Suggestions
- Restrict authenticated requests to the expected HTTPS origin by default:
- Require the
httpsscheme. - Compare the normalized hostname against an explicit allowlist.
- Reject URLs containing unexpected credentials, ports, or malformed hostnames.
- Require the
- If custom API endpoints are necessary, require an explicit high-friction opt-in and display the exact destination before sending credentials.
- Bind stored credentials to their configured origin. Do not automatically send a key loaded for
ai-hive.iclip.cnto a different hostname. - Prefer a separate API key argument or configuration profile for each custom endpoint.
- Reject plain HTTP endpoints except for an explicitly enabled local-development mode, and never reuse production credentials in that mode.
- Add automated tests confirming that environment and CLI overrides cannot redirect a stored credential without explicit authorization.
- Document the security implications of
AI_HIVE_BASE_URLand--base-url.
- Restrict authenticated requests to the expected HTTPS origin by default: