T09 · Insecure Skill Coding Practices
Error
- Location
- skills/smyx_common/scripts/config-dev.yaml:2
- Finding
- Sensitive video, identity, and authentication data transmitted over plaintext HTTP## Vulnerability Details **File Location**: `skills/smyx_common/scripts/config.yaml:15`; `skills/smyx_common/scripts/config-dev.yaml:2-4`; `skills/smyx_analysis/scripts/skill.py:113-130`; `skills/smyx_common/scripts/util.py:541-561, 610-646` **Vulnerability Type**: Plaintext transmission of sensitive information **Risk Level**: High ### Vulnerable Code The default configuration activates the development profile: ```yaml env: dev ``` That profile replaces the HTTPS production services with plaintext HTTP endpoints: ```yaml ApiEnum: base-url-open-api: "http://192.168.1.234:9601/smyx-open-api" base-url-open-h5: "http://192.168.1.234:4100" base-url-health: "http://192.168.1.234:7070/jeecg-boot-xzgz" ConstantEnum: is-debug: true ``` Local monitoring videos are read and supplied to the request layer for upload: ```python if (input_path.startswith("http://") or input_path.startswith("https://")): params.update({ "videoUrl": input_path }) else: _validate_file(input_path) mime_type, _ = mimetypes.guess_type(input_path) if mime_type is None: mime_type = 'application/octet-stream' with open(input_path, 'rb') as f: file_content = f.read() files = { 'file': (os.path.basename(input_path), file_content, mime_type) } ``` The registration request transmits the derived identity as both an Open ID and a mobile value: ```python def _get_or_create_user(username): _url = ApiEnum.BASE_URL_HEALTH + "/sys/phoneLogin" open_id = username _data = { "silent": 1, "register": 1, "openId": open_id, "mobile": username, "source": ConstantEnum.DEFAULT__SKILL_HUB_NAME } try: _response = requests.post(_url, json=_data) if _response.status_code == 200: _response_json = _response.json() if _response_json and _response_ ...[truncated 3999 chars]
- Remediation
- ## Remediation Suggestions 1. Remove `env: dev` from the distributed production configuration and use the HTTPS production profile by default. 2. Require HTTPS for every endpoint carrying media, identities, tokens, reports, or analysis metadata. 3. Reject non-HTTPS URLs at runtime except for an explicitly enabled, localhost-only development mode. 4. Do not permit private-network development endpoints in production packages. 5. Retain normal TLS certificate and hostname verification and fail closed on certificate errors. 6. Add an endpoint allowlist so media and credentials can only be sent to documented, trusted service origins. 7. Avoid populating the `mobile` field with an internal identity unless that field is required and semantically correct. 8. Minimize transmitted identity attributes and prefer a random, installation-scoped pseudonymous identifier. 9. Clearly disclose that videos are uploaded to a cloud service and obtain user consent before transmitting sensitive monitoring footage. 10. Rotate any tokens that may already have crossed plaintext transport and review server logs for suspicious replay activity. 11. Add automated configuration tests that fail builds when production profiles contain `http://` service URLs.