T09 · Insecure Skill Coding Practices
Error
- Location
scripts/video_gen.js:24- Finding
Unrestricted API Endpoint Overrides Can Exfiltrate the WeryAI API Key
- Content
View full analysis
controller.abort(), 30_000); try { const res = await fetch(fullUrl, { method, headers, body: body != null ? JSON.stringify(body) : undefined, signal: controller.signal, }); clearTimeout(timer); let data; try { data = await res.json(); } catch { data = { status: res.status, msg: `Non-JSON response (HTTP ${res.status})` }; } return { httpStatus: res.status, ...data }; } catch (err) { clearTimeout(timer); if (err.name === 'AbortError') { throw new Error(`Request timeout: ${method} ${fullUrl}`); } throw err; } } async function apiRequest(method, path, body, apiKey) { return httpJson(method, BASE_URL + path, body, apiKey); } async function fetchModelsRegistry(apiKey) { return httpJson('GET', MODELS_BASE_URL + MODELS_API_PATH, null, apiKey); } ``` ### Technical Analysis The Skill legitimately requires network access to WeryAI and must transmit `WERYAI_API_KEY` as a bearer token to the official service. However, both credential-bearing destinations can be replaced through `WERYAI_BASE_URL` and `WERYAI_MODELS_BASE_URL`. The script performs no URL-scheme validation, hostname allowlisting, or explicit authorization before attaching the bearer token. Consequently, an arbitrary destinat ...[truncated 2391 chars]- Remediation
View remediation