T09 · Insecure Skill Coding Practices
- Location
lib/api-client.js:50- Finding
Access Token Transmitted over Unencrypted HTTP
- Content
View full analysis
Vulnerability Details
File Location:
lib/api-client.js:50-57,lib/api-client.js:92-102,SKILL.md:42-50,references/examples.md:7-15
Vulnerability Type: Cleartext transmission of authentication credentials
Risk Level: HighThe documentation recommends a plain-HTTP service URL, while the HTTP client permits that protocol and attaches the access token to every request.
js function request(url, options = {}) { return new Promise((resolve, reject) => { const isHttps = url.startsWith('https:'); const client = isHttps ? https : http; const urlObj = new URL(url); const reqOptions = {js async function apiRequest(endpoint, method = 'POST', body = null) { const config = loadConfig(); const url = `${config.baseUrl}${endpoint}`; const options = { method, headers: { 'Accept': 'application/json', 'Content-Type': 'application/json', 'X-Access-Token': config.token } };The documented configuration explicitly uses HTTP:
bash export VALIDATE_BASE_URL=http://global-masterdata-http.default.yf-bw-test-2.test.51baiwang.com export VALIDATE_TOKEN=your-token-herejson { "baseUrl": "http://global-masterdata-http.default.yf-bw-test-2.test.51baiwang.com", "token": "your-token-here" }Technical Analysis
HTTP does not provide transport encryption, server authentication, or message integrity. When the configured base URL uses HTTP, the
X-Access-Tokenheader, request bodies, and API responses are transmitted in cleartext.An attacker capable of observing or modifying traffic between the CLI and the service could capture the token or tamper with administrative requests. Because this CLI supports create, update, enable, disable, and delete operations, the consequences depend on the permissions granted to the intercepted token.
Attack Path
- A user follows the documented setup and co ...[truncated 992 chars]
- Remediation
View remediation
Remediation Suggestions
- Require the configured base URL to use the
https:protocol and reject HTTP URLs before constructing a request. - Replace all HTTP URLs in
SKILL.md,references/examples.md, and CLI help text with verified HTTPS endpoints. - If plain HTTP is unavoidable for isolated local development, require an explicit opt-in flag such as
ALLOW_INSECURE_HTTP=true, display a prominent warning, and prohibit its use with non-loopback hosts. - Preserve normal TLS certificate and hostname validation; do not introduce options that disable certificate verification.
- Rotate tokens that may already have been transmitted over untrusted HTTP networks.
- Apply least-privilege and short expiration periods to API tokens to reduce the impact of interception.
- Require the configured base URL to use the