T09 · Insecure Skill Coding Practices
- Location
scripts/imagegen.py:58- Finding
Bearer API Key Disclosure Through an Unrestricted Custom Base URL
- Content
View full analysis
Vulnerability Details
File Location:
scripts/imagegen.py:58-69andscripts/imagegen.py:106-121
Vulnerability Type: Unrestricted credential-bearing endpoint configuration
Risk Level: HighComplete Code Snippet:
python def _resolve_base_url(self, cli_url): if cli_url: return cli_url.rstrip("/") env_url = os.environ.get("AI_HIVE_BASE_URL") if env_url: return env_url.rstrip("/") file_config = self._read_config_file() if file_config.get("base_url"): return file_config["base_url"].rstrip("/") return DEFAULT_BASE_URLpython class AiHiveClient: """Encapsulates AI Hive OpenAPI HTTP calls.""" def __init__(self, config): self.config = config self.base = config.base_url self.headers = { "Authorization": f"Bearer {config.api_key}", "Content-Type": "application/json", } def _url(self, path): return f"{self.base}/openapi/v1/{path}" def _request(self, method, url, **kwargs): self.config.log(f"{method} {url}") try: resp = requests.request( method, url, headers=self.headers, timeout=DEFAULT_TIMEOUT, **kwargs )Technical Analysis
The API base URL may be supplied through the
--base-urlcommand-line option, theAI_HIVE_BASE_URLenvironment variable, or the persistent configuration file. The value is accepted without validating its scheme or hostname.The client subsequently attaches the AI Hive API key as a bearer token to every request sent to the configured endpoint. Consequently, an attacker-controlled base URL receives the user's
Authorizationheader. The implementation does not enforce HTTPS, restrict destinations to trusted AI Hive domains, separate credentials by endpoint, or warn the user before sending credentials to a custom host.Attack Path
- An atta ...[truncated 1129 chars]
- Remediation
View remediation
Remediation Suggestions
- Restrict authenticated API requests to an explicit allowlist of trusted HTTPS hostnames, such as the documented AI Hive API host.
- Parse the URL using a standard URL parser and reject:
- Plaintext HTTP endpoints
- Embedded usernames or passwords
- Unapproved hostnames
- Unexpected ports
- Malformed or ambiguous URLs
- If custom endpoints are a required feature, do not automatically reuse the production AI Hive key. Require endpoint-specific credentials and explicit user confirmation.
- Display the validated destination hostname before transmitting credentials to a custom endpoint.
- Consider removing custom base URL support from normal skill commands when it is not essential.
- Advise affected users to revoke and rotate any API key that may have been sent to an untrusted endpoint.