T09 · Insecure Skill Coding Practices
Error
- Location
- scripts/main.mjs:5
- Finding
- Bearer Credential Disclosure Through an Unvalidated API Base URL<![CDATA[ ## Vulnerability Details **File Location**: `scripts/main.mjs:5`, `scripts/main.mjs:36-40` **Vulnerability Type**: Unvalidated credential destination **Risk Level**: High ### Vulnerable Code ```js const API_BASE = process.env.CRAZYROUTER_BASE_URL || "https://crazyrouter.com/v1"; ``` ```js const response = await fetch(`${API_BASE}/chat/completions`, { method: "POST", headers: { "Authorization": `Bearer ${apiKey}`, "Content-Type": "application/json" }, body: JSON.stringify({ model: args.model, messages: [{ role: "user", content: args.prompt }] }), }); ``` ### Technical Analysis The script permits `CRAZYROUTER_BASE_URL` to control the destination of an authenticated HTTP request. It does not validate the URL scheme, hostname, port, or relationship to the legitimate Crazyrouter service before adding the API key to the `Authorization` header. Although `SKILL.md` documents `CRAZYROUTER_API_KEY`, it does not document this endpoint override. A compromised launcher, shell profile, CI configuration, container environment, or wrapper capable of setting environment variables can silently redirect requests to an attacker-controlled service. The request also contains the user's complete video-generation prompt. Consequently, both the bearer credential and user-provided content are disclosed to the selected endpoint. ### Attack Path 1. An attacker gains the ability to influence the environment used to invoke the Skill, such as through a malicious wrapper, poisoned CI configuration, or modified container environment. 2. The attacker sets `CRAZYROUTER_BASE_URL` to an attacker-controlled endpoint, for example `https://attacker.example/v1`. 3. A user invokes the Skill normally with a valid `CRAZYROUTER_API_KEY`. 4. The script sends a POST request to `https://attacker.example/v1/chat/completions`. 5. The request includes `Authorization: Bearer <CRAZYROUTER_API_KEY>` and the user's prompt. 6. The attacker captures the credential and can use it against the le ...[truncated 510 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Remove `CRAZYROUTER_BASE_URL` if custom endpoints are not an explicit product requirement. 2. If endpoint customization is required, parse the URL with `new URL()` and enforce: - The `https:` scheme. - An explicit allowlist of trusted hostnames. - Approved ports and API path prefixes. - Rejection of embedded credentials and malformed URLs. 3. Do not attach the bearer token until the destination has passed validation. 4. Disable redirects for authenticated requests where possible, or validate every redirect destination before resending credentials. 5. Document any supported endpoint override and its security implications. 6. Use a narrowly scoped API key, apply spending limits, and rotate any key that may have been used with an untrusted endpoint. ]]>