T09 · Insecure Skill Coding Practices
Error
- Location
scripts/pansou.py:29- Finding
Credentials and bearer tokens may be transmitted over plaintext HTTP
- Content
View full analysis
Dict[str, str]: """Return request headers containing authentication.""" return { "Content-Type": "application/json", "Accept": "application/json", "Authorization": f"Bearer {token}", } ``` The documentation also gives a plaintext HTTP endpoint as an example: ```text PANSOU_URL service address (for example, http://localhost:8888) ``` ### Technical Analysis The Skill reads `PANSOU_URL` directly from the environment and does not validate its URL scheme or destination before transmitting authentication information. The login request sends the configured username and password in a JSON body, while subsequent authenticated requests send a reusable JWT bearer token in the `Authorization` header. Network transmission is necessary for the declared PanSou search functionality, and the code does not contain evidence of a covert or hardcoded recipient. However, allowing credentials and tokens to be sent through an arbitrary endpoint without requiring TLS creates an insecure transport path. This is particularly risky because the documentation explicitly permits an `http://` endpoint without limiting that exception to loopback addresses. ### Attack Path 1. A user or deployment configures `PANSOU_URL` with an unencrypted HTTP endpoint, or an attacker influences that configuration to reference an attacker-controlled server. 2. The user invokes `login`, `verify`, or ...[truncated 960 chars]- Remediation
View remediation