The Agent Skills Directory

[CREDENTIALS_UNSAFE]: The SessionMiddleware is configured with a hardcoded default secret key ('change-me-in-production') if the API_COOKIE_SECRET environment variable is not provided. This allows attackers to forge session cookies and potentially hijack user sessions. \n- Evidence: secret_key=os.getenv("API_COOKIE_SECRET", "change-me-in-production") in app/auth/setup.py. \n- [PRIVILEGE_ESCALATION]: The skill includes a TEST_MODE bypass that allows any user to impersonate another by providing an X-Test-User header. If this mode is accidentally enabled in a production or staging environment, it constitutes a complete authentication bypass. \n- Evidence: if _TEST_MODE: return request.headers.get("X-Test-User", "test.user@example.com").lower() in app/utils/auth.py. \n- [COMMAND_EXECUTION]: The role-based access control (RBAC) lookup uses string interpolation to build a database query. While the code uses an unpacking operator (*) which typically suggests parameterization, the use of template interpolation ({email}) presents a risk of SQL injection if the underlying helper is misconfigured. \n- Evidence: t"SELECT role FROM dim.user_roles WHERE email = {email}" in app/utils/auth.py. \n- [DATA_EXFILTRATION]: The /callback route contains an insecure check for open redirects that only looks for the literal string '://'. Attackers can bypass this using relative protocol URLs (e.g., //attacker.com) to redirect users to malicious sites, potentially exfiltrating authentication tokens. \n- Evidence: if "://" in redir: redir = "/" in app/auth/setup.py.

fastapi-azure-auth