T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/gemini.py:23- Finding
Unrestricted Gateway URL Can Expose API Credentials and User Content
- Content
View full analysis
genai.Client: base_url = os.environ.get("CS_AI_GATEWAY_BASE_URL", "") api_token = os.environ.get("CS_AI_GATEWAY_API_TOKEN", "") if not base_url or not api_token: msg = "CS_AI_GATEWAY_BASE_URL and CS_AI_GATEWAY_API_TOKEN are required." if json_mode: typer.echo(json_lib.dumps({"ok": False, "error": msg})) else: typer.echo(f"Error: {msg}", err=True) raise typer.Exit(1) return genai.Client( api_key=api_token, http_options=types.HttpOptions(base_url=f"{base_url.rstrip('/')}/google-ai-studio"), ) ``` The client subsequently submits prompts and input files to the configured endpoint: ```python response = client.models.generate_content( model=model, contents=types.Content(role="user", parts=parts), config=types.GenerateContentConfig(response_modalities=resp_mod), ) ``` ### Technical Analysis `CS_AI_GATEWAY_BASE_URL` directly controls the base URL supplied to the Google GenAI client. The code only verifies that the value is nonempty. It does not validate the URL scheme, hostname, port, embedded credentials, or destination. The same client is initialized with `CS_AI_GATEWAY_API_TOKEN` and later transmits user prompts and image content through `generate_content`. Consequently, a process, deployment configuration, wrapper script, or other actor capable of modifying the gateway environment variable can redirect security-sensitive requests to an unintended endpoint. The risk is conditional on an attacker being able to influence the environment or deployment configuration. The code does not independently create that capability, but it lacks a security bounda ...[truncated 1228 chars]- Remediation
View remediation