T09 · Insecure Skill Coding Practices
Error
- Location
- scripts/main.mjs:4
- Finding
- Configurable API Endpoint Can Expose Credentials and Document Contents## Vulnerability Details **File Location**: `scripts/main.mjs`, lines 4 and 47–55 **Vulnerability Type**: Unrestricted destination for sensitive network transmission **Risk Level**: High ### Vulnerable Code ```js const API_BASE = process.env.CRAZYROUTER_BASE_URL || "https://crazyrouter.com/v1"; ``` ```js const response = await fetch(`${API_BASE}/chat/completions`, { method: "POST", headers: { "Authorization": `Bearer ${apiKey}`, "Content-Type": "application/json" }, body: JSON.stringify({ model: args.model, messages: [{ role: "system", content: systemPrompt }, { role: "user", content: text }], temperature: 0.3, }), }); ``` ### Technical Analysis `CRAZYROUTER_BASE_URL` fully controls the server receiving the request. The script does not restrict the destination host, enforce the expected Crazyrouter origin, or require HTTPS. Every request forwards two sensitive values to the configured destination: 1. `CRAZYROUTER_API_KEY` in the `Authorization` header. 2. The complete text being translated, including the contents of a file supplied through `--input`, in the JSON request body. Although transmitting translation content to Crazyrouter is necessary and documented for this hosted translation service, permitting an unrestricted and undocumented endpoint override exceeds the minimum privileges required for the declared Crazyrouter-only functionality. An attacker who can influence the process environment can redirect both the credential and document content to an attacker-controlled server. ### Attack Path 1. An attacker, compromised launcher, CI configuration, shell profile, or wrapper script sets `CRAZYROUTER_BASE_URL` to an attacker-controlled HTTP or HTTPS endpoint. 2. The user invokes the Skill with `--text` or `--input`, believing the content will be sent to Crazyrouter. 3. The script reads the supplied text or complete input file. 4. It constructs a request using the attacker- ...[truncated 897 chars]
- Remediation
- ## Remediation Suggestions 1. Remove `CRAZYROUTER_BASE_URL` if custom endpoints are not required and use a fixed, trusted HTTPS URL. 2. If endpoint configurability is necessary, require explicit user opt-in and document the security implications. 3. Parse the URL before use and enforce the `https:` scheme. 4. Restrict the hostname and port to an explicit allowlist of trusted Crazyrouter endpoints. 5. Reject URLs containing embedded credentials, unexpected ports, untrusted subdomains, or ambiguous host representations. 6. Do not send the production Crazyrouter credential to custom hosts. Require a separate credential when a nonstandard endpoint is explicitly supported. 7. Clearly notify users before transmitting file contents to an external service and advise them not to submit secrets or confidential files without authorization. 8. Add automated tests confirming that HTTP URLs, lookalike domains, and unauthorized hosts are rejected before any request is sent.