T09 · Insecure Skill Coding Practices
Error
- Location
scripts/taker_api.py:15- Finding
API Key Can Be Transmitted to an Arbitrary User-Controlled Server
- Content
View full analysis
EnvConfig: """Resolve final base URL from env / override.""" if not api_key: raise SystemExit("api_key is required for Taker API calls.") if base_url: return EnvConfig(base_url=base_url.rstrip("/"), api_key=api_key) if env == "test": return EnvConfig(base_url="https://api-qa.proto.stove.finance", api_key=api_key) # default: production return EnvConfig(base_url="https://proto.stove.finance", api_key=api_key) def _build_request( url: str, method: str, cfg: EnvConfig, body: Optional[Dict[str, Any]] = None, ) -> request.Request: if body is not None: data = json.dumps(body).encode("utf-8") else: data = None req = request.Request(url, method=method, data=data) req.add_header("Content-Type", "application/json") req.add_header("X-API-Key", cfg.api_key) return req ``` The unrestricted override is also exposed as a command-line option at `scripts/taker_api.py:176-179`: ```python parser.add_argument( "--base-url", help="可选：自定义 API 根地址，设置后优先生效。", ) ``` ### Technical Analysis The `--base-url` option accepts an arbitrary URL without validating its scheme, hostname, port, or destination. Every request created for the selected URL receives the sensitive `X-API-Key` header. Sending an API key over the network is necessary for the Skill's declared API functionality when the destination is a trusted Stove Protocol service. Allowing the same credential to be sent to an arbitrary destination exceeds that minimum requirement. No controls limit requests to the two documented endpoints: - `https://proto.stove.finance` - `https://api-qa.proto.stove.finance` The implementation also does not explicitl ...[truncated 1733 chars]- Remediation
View remediation