T09 · Insecure Skill Coding Practices
- Location
scripts/imagegen.py:90- Finding
Bearer API Key Can Be Transmitted to an Arbitrary Caller-Controlled Endpoint
- Content
View full analysis
Vulnerability Details
File Location:
scripts/imagegen.py:90-99,scripts/imagegen.py:130-143, andscripts/imagegen.py:587
Vulnerability Type: Unrestricted API endpoint configuration leading to credential disclosure
Risk Level: MediumVulnerable code:
python def _resolve_base_url(self, cli_url): if cli_url: return cli_url.rstrip("/") env_url = os.environ.get("AI_HIVE_BASE_URL") if env_url: return env_url.rstrip("/") file_config = self._read_config_file() if file_config.get("base_url"): return file_config["base_url"].rstrip("/") return DEFAULT_BASE_URLpython def __init__(self, config): self.config = config self.base = config.base_url self.headers = { "Authorization": f"Bearer {config.api_key}", "Content-Type": "application/json", } def _url(self, path): return f"{self.base}/openapi/v1/{path}" def _request(self, method, url, **kwargs): self.config.log(f"{method} {url}") try: resp = requests.request( method, url, headers=self.headers, timeout=DEFAULT_TIMEOUT, **kwargs )python parser.add_argument("--base-url", help=f"API Base URL (default {DEFAULT_BASE_URL})")Technical Analysis
The API base URL can be supplied through the
--base-urlargument, theAI_HIVE_BASE_URLenvironment variable, or~/.ai-hive/config.json. The value is used without validating its scheme or hostname.The HTTP client then attaches the user's AI Hive bearer credential to every request made through
_request(). Consequently, an attacker-controlled base URL receives theAuthorizationheader. The implementation also permits anhttp://URL, which could expose the credential to network interception.This is a credential-routing vulnerability: an authentication token intended for the official service is not bound to the trusted service ...[truncated 1054 chars]
- Remediation
View remediation
Remediation Suggestions
- Require
https://for all authenticated API endpoints and reject plaintext HTTP. - Allowlist the official AI Hive hostname for normal operation.
- If custom endpoints are necessary, require an explicit opt-in option and display a prominent warning before sending credentials.
- Bind credentials to origins: do not attach the production API key when the request hostname differs from the approved hostname.
- Parse URLs with a standard URL parser and reject credentials in URLs, unsupported schemes, malformed hosts, and ambiguous hostname representations.
- Treat environment and configuration-file endpoint overrides as untrusted input.
- Consider using separate credentials specifically provisioned for approved custom endpoints.
- Add automated tests confirming that bearer credentials are never sent to unapproved hosts or over plaintext connections.
- Require