T09 · Insecure Skill Coding Practices
Error
- Location
- SKILL.md:52
- Finding
- Unvalidated API Base URL Can Disclose Bearer Credentials and Note Content<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 52–85 **Vulnerability Type**: Unvalidated external API endpoint configuration **Risk Level**: High ### Vulnerable Code ```bash ## Snapshot-Before-Edit Pattern ```bash # 1) backup curl -s -X POST "$PULSE_BASE/os/snapshots/42" \ -H "Authorization: Bearer $AICOO_API_KEY" \ -H "Content-Type: application/json" \ -d '{"label":"Pre-edit backup"}' | jq . # 2) edit curl -s -X PATCH "$PULSE_BASE/os/notes/42" \ -H "Authorization: Bearer $AICOO_API_KEY" \ -H "Content-Type: application/json" \ -d '{"content":"# Updated content..."}' | jq . ``` ## Scheduled Backup Pattern ```bash # list notes in a folder NOTES=$(curl -s "$PULSE_BASE/os/notes?folderId=5&limit=200" \ -H "Authorization: Bearer $AICOO_API_KEY" | jq -r '.notes[].id') # backup each for id in $NOTES; do curl -s -X POST "$PULSE_BASE/os/snapshots/$id" \ -H "Authorization: Bearer $AICOO_API_KEY" \ -H "Content-Type: application/json" \ -d "{\"label\":\"Pre-sync $(date +%Y-%m-%d)\"}" | jq .success done ``` ### Technical Analysis The documented workflows construct privileged API requests from the variable `PULSE_BASE`, but the skill neither initializes this variable to the documented Aicoo endpoint nor validates its scheme and hostname before attaching the `AICOO_API_KEY` bearer token. An environment variable is an attacker-influenced configuration boundary in many agent, CI, shell, and hosted execution environments. If `PULSE_BASE` contains an attacker-controlled HTTPS URL, `curl` sends the Authorization header directly to that server. The snapshot-before-edit workflow can also transmit note content in the PATCH request body. The scheduled workflow may disclose note identifiers returned by the notes API or cause bulk requests to an unintended service. This differs from the earlier examples that use the fixed endpoint `https://www.aicoo.io/api/v1`. The inconsistent base URL handling creates a credential-exfiltr ...[truncated 1381 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Replace `PULSE_BASE` with a fixed, trusted endpoint in every example: ```bash AICOO_BASE="https://www.aicoo.io/api/v1" ``` 2. If endpoint configurability is required, validate it before sending credentials. Require: - The `https` scheme. - The exact expected hostname, such as `www.aicoo.io`. - The expected API path prefix. - No embedded user information, unexpected port, or hostname suffix substitution. 3. Fail closed when the variable is absent or invalid: ```bash : "${AICOO_API_KEY:?AICOO_API_KEY is required}" AICOO_BASE="${AICOO_BASE:-https://www.aicoo.io/api/v1}" if [ "$AICOO_BASE" != "https://www.aicoo.io/api/v1" ]; then echo "Refusing to send credentials to an untrusted API endpoint" >&2 exit 1 fi ``` 4. Configure `curl` to fail on HTTP errors and avoid following redirects to unintended hosts: ```bash curl --fail --silent --show-error \ -X POST "$AICOO_BASE/os/snapshots/42" \ -H "Authorization: Bearer $AICOO_API_KEY" \ -H "Content-Type: application/json" \ -d '{"label":"Pre-edit backup"}' ``` 5. Document that agents must never send `AICOO_API_KEY` or note content to a user-supplied or environment-supplied host without explicit trust validation. 6. Apply least privilege and short expiration to API credentials. Rotate the key immediately if an affected workflow may have been executed with an untrusted `PULSE_BASE`. ]]>