T09 · Insecure Skill Coding Practices
Error
- Location
- scripts/gmail-wiki-ingest.js:47
- Finding
- Redirectable server endpoint can disclose the shared gateway bearer token and private user data<![CDATA[ ## Vulnerability Details **File Location**: `scripts/gmail-wiki-ingest.js:47-48, 100-112` **Vulnerability Type**: Unvalidated network destination for authenticated requests **Risk Level**: High ### Vulnerable Code ```js const SERVER = process.env.JAVIS_SERVER_URL || 'http://javis-server:8000'; const SKILL = 'gmail-wiki-ingest'; ``` ```js async function postJson(path, body, deps = {}) { const fetchFn = deps.fetch || globalThis.fetch; const token = deps.token || requireToken(); let res; try { res = await fetchFn(`${SERVER}${path}`, { method: 'POST', headers: { 'Content-Type': 'application/json', Authorization: `Bearer ${token}`, }, body: JSON.stringify(body), }); ``` ### Technical Analysis The destination of every authenticated request is derived from the environment-controlled `JAVIS_SERVER_URL`. The code performs no validation of its scheme, hostname, port, or origin before attaching `OPENCLAW_GATEWAY_TOKEN` as a bearer credential. Consequently, a party able to influence the Skill's environment can direct `fetch`, `content`, `submit`, or `report` requests to an attacker-controlled server. The attacker would receive both the bearer token and the associated request body. Depending on the command, that body may include selected Gmail thread identifiers, email-derived verdicts and reasons, or report content. The default destination also uses plaintext HTTP. While `javis-server` appears intended to be an internal service, the code does not verify that the destination remains local or trusted. If traffic crosses an untrusted network segment, credentials and private data could be exposed to interception. This exceeds strict least privilege because the credential is documented as a container-wide token shared by installed skills rather than a credential scoped solely to Gmail ingestion. ### Attack Path 1. An attacker gains control over the process or container configuration sufficiently to set ` ...[truncated 1340 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Remove `JAVIS_SERVER_URL` configurability from production builds where it is unnecessary. 2. If configuration is required, parse the URL with `new URL()` and enforce an exact allowlist of trusted origins, including the expected scheme, hostname, and port. 3. Require HTTPS for non-loopback and non-verified internal destinations. Reject arbitrary plaintext HTTP endpoints. 4. Prefer a per-Skill credential restricted to the exact Gmail-ingest endpoints instead of a container-wide user credential. 5. Configure requests to reject redirects, or independently validate every redirect destination before allowing credentials to be forwarded. 6. Separate authorization scopes for candidate retrieval, verdict submission, and chat reporting where supported. 7. Add tests proving that unapproved hosts, user-info URLs, unexpected ports, and insecure schemes are rejected before the token is read or attached. 8. Avoid including sensitive response details or credentials in network-error logs. ]]>