T09 · Insecure Skill Coding Practices
- Location
scripts/generate_ark_video.py:24- Finding
Ark API Credential and User Prompt Disclosure Through an Unrestricted Task Endpoint
- Content
View full analysis
Vulnerability Details
File Location:
scripts/generate_ark_video.py, lines 24-30, 84-94, and 151-157
Vulnerability Type: Arbitrary authenticated endpoint / sensitive information disclosure
Risk Level: HighVulnerable Code
python parser.add_argument("--api-key", help="Ark API key, otherwise read from environment") parser.add_argument("--model", default=os.environ.get("ARK_VIDEO_MODEL", DEFAULT_MODEL), help="Model name") parser.add_argument( "--tasks-url", default=os.environ.get("ARK_VIDEO_TASKS_URL", DEFAULT_TASKS_URL), help="Task endpoint URL", )python def request_json(method: str, url: str, api_key: str, data: dict | None = None) -> dict: req = urllib.request.Request(url, method=method) req.add_header("Content-Type", "application/json") req.add_header("Authorization", f"Bearer {api_key}") payload = None if data is not None: payload = json.dumps(data).encode("utf-8") try: with urllib.request.urlopen(req, data=payload) as response: body = response.read().decode("utf-8")python task_payload = request_json("POST", args.tasks_url, api_key, payload) task_id = extract_task_id(task_payload) if not task_id: raise RuntimeError(f"Task created without id: {json.dumps(task_payload, ensure_ascii=False)}") start_time = time.time() last_status_payload = None while True: last_status_payload = request_json("GET", f"{args.tasks_url}/{task_id}", api_key)Technical Analysis
The task endpoint can be supplied through either the
--tasks-urlcommand-line argument or theARK_VIDEO_TASKS_URLenvironment variable. The supplied value is not restricted to the declared Volcengine Ark service, is not required to use HTTPS, and is not checked against an approved hostname.The
request_json()function unconditionally adds the resolved Ark API key as a bearer token to every request. The ini ...[truncated 2700 chars]- Remediation
View remediation
Remediation Suggestions
-
Remove unnecessary endpoint configurability. If this Skill exclusively supports Volcengine Ark, use the fixed official endpoint and remove
--tasks-urlandARK_VIDEO_TASKS_URL. -
Apply an exact destination allowlist. If endpoint overrides are operationally required:
- Require the
httpsscheme. - Permit only documented Volcengine Ark hostnames, such as
ark.cn-beijing.volces.com. - Reject embedded credentials, fragments, unexpected ports, IP literals, and hostname suffix tricks.
- Normalize the hostname before comparison and use exact matching rather than substring or suffix matching.
- Require the
-
Secure redirect handling. Disable automatic redirects for authenticated requests or validate every redirect target before forwarding the
Authorizationheader. Never forward credentials across origins. -
Separate endpoint trust from user input. Do not allow ordinary prompt content or agent-controlled parameters to select the authenticated service endpoint. Endpoint configuration should come only from trusted administrator-controlled configuration.
-
Fail closed. Abort generation when endpoint validation fails. Do not silently fall back to or contact an unapproved destination.
-
Use least-privilege credentials. Use a key scoped only to the required video-generation API, with quotas, expiration, monitoring, and rotation enabled.
-
Warn on exceptional configuration. If support for non-default official regional endpoints is necessary, display the validated destination and require explicit confirmation before transmitting credentials and prompt data.
-
Add security tests. Cover HTTP URLs, lookalike domains, attacker-controlled subdomains, embedded user information, alternate ports, IP addresses, and cross-origin redirects. Verify that no bearer token is sent when validation fails.
-