T09 · Insecure Skill Coding Practices
Warning
- Location
- references/HTTP-REQUESTS.md:3
- Finding
- Configurable API Origin Can Expose Bearer Credentials and Spreadsheet Data## Vulnerability Details **File Location**: `references/HTTP-REQUESTS.md`, line 3 **Vulnerability Type**: Unrestricted API endpoint configuration and credential forwarding **Risk Level**: Medium ### Vulnerable Configuration ```text ${AI_SKILLS_API_URL:-https://ai-skills.open-idea.net}/api/v1/spreadsheet-analysis/spreadsheet.analyze Authorization: Bearer ${SPREADSHEET_ANALYSIS_API_KEY} Content-Type: application/json ``` The documented request sends the extracted spreadsheet document to a base URL controlled through `AI_SKILLS_API_URL`, while attaching the spreadsheet-analysis bearer credential. ### Technical Analysis The API base URL is configurable through an environment variable, but the instructions do not require HTTPS, validate the destination hostname, or define an allowlist of trusted origins. The bearer credential is attached to requests made using this configurable URL. If an attacker can influence the Agent or Gateway environment, the attacker can set `AI_SKILLS_API_URL` to a server under their control. Subsequent analysis, question, comparison, or export requests may then disclose the API key and request content to that server. This is an insecure configuration pattern rather than evidence of intentional credential theft. The default endpoint uses HTTPS and points to the declared service, but the unrestricted override weakens that protection. ### Attack Path 1. An attacker obtains the ability to alter the environment or deployment configuration used by the Skill. 2. The attacker sets `AI_SKILLS_API_URL` to an attacker-controlled HTTP or HTTPS endpoint. 3. A user invokes spreadsheet analysis, question answering, comparison, or export. 4. The Agent follows the documented request procedure and sends an `Authorization: Bearer` header to the configured endpoint. 5. The attacker receives the API credential and any spreadsheet-derived content included in the request. 6. The stolen credential may be reused aga ...[truncated 764 chars]
- Remediation
- ## Remediation Suggestions 1. Pin production requests to `https://ai-skills.open-idea.net` unless endpoint customization is an explicit operational requirement. 2. If customization is required, parse and validate the URL before sending any request: - Require the `https` scheme. - Allowlist exact trusted hostnames and ports. - Reject embedded user information, malformed hosts, IP-literal bypasses, and unapproved subdomains. 3. Do not attach the `Authorization` header until the final request origin has passed validation. 4. Disable cross-origin redirects or revalidate every redirect target before forwarding credentials. 5. Separate development credentials from production credentials and scope keys to the minimum necessary product permissions. 6. Document the endpoint override as security-sensitive configuration and protect it from untrusted process, project, and user-level environment changes. 7. Rotate the API key if requests may already have been sent to an untrusted endpoint.