T09 · Insecure Skill Coding Practices
Error
- Location
- scripts/generate_ark_video.py:24
- Finding
- Ark API Credential and User Prompt Disclosure Through an Unrestricted Task Endpoint## Vulnerability Details **File Location**: `scripts/generate_ark_video.py`, lines 24-30, 84-94, and 151-157 **Vulnerability Type**: Arbitrary authenticated endpoint / sensitive information disclosure **Risk Level**: High ### Vulnerable Code ```python parser.add_argument("--api-key", help="Ark API key, otherwise read from environment") parser.add_argument("--model", default=os.environ.get("ARK_VIDEO_MODEL", DEFAULT_MODEL), help="Model name") parser.add_argument( "--tasks-url", default=os.environ.get("ARK_VIDEO_TASKS_URL", DEFAULT_TASKS_URL), help="Task endpoint URL", ) ``` ```python def request_json(method: str, url: str, api_key: str, data: dict | None = None) -> dict: req = urllib.request.Request(url, method=method) req.add_header("Content-Type", "application/json") req.add_header("Authorization", f"Bearer {api_key}") payload = None if data is not None: payload = json.dumps(data).encode("utf-8") try: with urllib.request.urlopen(req, data=payload) as response: body = response.read().decode("utf-8") ``` ```python task_payload = request_json("POST", args.tasks_url, api_key, payload) task_id = extract_task_id(task_payload) if not task_id: raise RuntimeError(f"Task created without id: {json.dumps(task_payload, ensure_ascii=False)}") start_time = time.time() last_status_payload = None while True: last_status_payload = request_json("GET", f"{args.tasks_url}/{task_id}", api_key) ``` ### Technical Analysis The task endpoint can be supplied through either the `--tasks-url` command-line argument or the `ARK_VIDEO_TASKS_URL` environment variable. The supplied value is not restricted to the declared Volcengine Ark service, is not required to use HTTPS, and is not checked against an approved hostname. The `request_json()` function unconditionally adds the resolved Ark API key as a bearer token to every request. The ini ...[truncated 2700 chars]
- Remediation
- ## Remediation Suggestions 1. **Remove unnecessary endpoint configurability.** If this Skill exclusively supports Volcengine Ark, use the fixed official endpoint and remove `--tasks-url` and `ARK_VIDEO_TASKS_URL`. 2. **Apply an exact destination allowlist.** If endpoint overrides are operationally required: - Require the `https` scheme. - Permit only documented Volcengine Ark hostnames, such as `ark.cn-beijing.volces.com`. - Reject embedded credentials, fragments, unexpected ports, IP literals, and hostname suffix tricks. - Normalize the hostname before comparison and use exact matching rather than substring or suffix matching. 3. **Secure redirect handling.** Disable automatic redirects for authenticated requests or validate every redirect target before forwarding the `Authorization` header. Never forward credentials across origins. 4. **Separate endpoint trust from user input.** Do not allow ordinary prompt content or agent-controlled parameters to select the authenticated service endpoint. Endpoint configuration should come only from trusted administrator-controlled configuration. 5. **Fail closed.** Abort generation when endpoint validation fails. Do not silently fall back to or contact an unapproved destination. 6. **Use least-privilege credentials.** Use a key scoped only to the required video-generation API, with quotas, expiration, monitoring, and rotation enabled. 7. **Warn on exceptional configuration.** If support for non-default official regional endpoints is necessary, display the validated destination and require explicit confirmation before transmitting credentials and prompt data. 8. **Add security tests.** Cover HTTP URLs, lookalike domains, attacker-controlled subdomains, embedded user information, alternate ports, IP addresses, and cross-origin redirects. Verify that no bearer token is sent when validation fails.