T09 · Insecure Skill Coding Practices
Error
- Location
- scripts/run.mjs:3
- Finding
- Undisclosed Cross-Domain API Credential Transmission<![CDATA[ ## Vulnerability Details **File Location**: `scripts/run.mjs`, lines 3, 40, 113–120, 125–126, and 158–162; related documentation in `SKILL.md`, lines 4 and 65 **Vulnerability Type**: API credential exposure to an insufficiently disclosed third-party domain **Risk Level**: High ### Complete Code Snippet ```javascript // scripts/run.mjs:3 const API_BASE = "https://api.heybossai.com/v1"; // scripts/run.mjs:40 const apiKey = (process.env.SKILLBOSS_API_KEY ?? "").trim(); // scripts/run.mjs:113-120 if (flags.models) { const modelsBody = { api_key: apiKey }; if (typeof flags.models === "string") modelsBody.types = flags.models; const resp = await fetch(`${API_BASE}/models`, { method: "POST", headers: { "Content-Type": "application/json" }, body: JSON.stringify(modelsBody), }); // scripts/run.mjs:125-126 const headers = { "Content-Type": "application/json" }; const body = { api_key: apiKey }; // scripts/run.mjs:158-162 const resp = await fetch(`${API_BASE}${endpoint}`, { method: "POST", headers, body: JSON.stringify(body), }); ``` The corresponding documentation associates the credential with a different domain: ```yaml # SKILL.md:4 metadata: {"clawdbot":{"requires":{"bins":["node"],"env":["SKILLBOSS_API_KEY"]},"primaryEnv":"SKILLBOSS_API_KEY"}} ``` ```markdown <!-- SKILL.md:65 --> - Get API key at https://www.skillboss.co ``` ### Technical Analysis The script reads the `SKILLBOSS_API_KEY` environment variable and embeds its value directly in the JSON body of requests sent to `https://api.heybossai.com/v1`. This occurs both when listing models and when invoking model or task endpoints. Remote transmission of prompts and other model inputs is necessary for the declared multi-model gateway functionality. However, the Skill documentation tells users to obtain the credential from `skillboss.co` without disclosing that the key will be sent to the distinct `heybossai.com` domain. The reviewed files provide no evidence establish ...[truncated 1990 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. **Disclose the actual recipient** - State explicitly in `SKILL.md` that requests and credentials are sent to `https://api.heybossai.com`. - Explain the relationship between `skillboss.co` and `heybossai.com`. - Document which user-provided fields leave the local environment. 2. **Use a standard authorization header** - Replace the JSON `api_key` field with an HTTP authorization header where supported: ```javascript const headers = { "Content-Type": "application/json", "Authorization": `Bearer ${apiKey}`, }; const body = {}; ``` - Ensure server, proxy, tracing, and error-reporting systems redact authorization headers. 3. **Minimize credential transmission** - Determine whether model and task discovery endpoints require authentication. - Do not send the key to endpoints that can safely operate without it. - Use narrowly scoped, revocable API tokens with appropriate rate and spending limits. 4. **Constrain and validate the endpoint** - Keep the API origin fixed to an explicitly documented HTTPS allowlist. - Do not permit arguments, model responses, or environment variables to override the credential destination. - Verify domain ownership and deployment configuration before release. 5. **Protect request data** - Disable request-body logging for authenticated endpoints. - Redact credentials and sensitive model inputs from diagnostics. - Establish retention and deletion policies for prompts, context, text, and media references. 6. **Support incident response** - Advise affected users to rotate keys if credentials may have been sent to an unintended recipient. - Provide token revocation, usage monitoring, and anomalous-spending alerts. ]]>