T09 · Insecure Skill Coding Practices
- Location
skill.json:7- Finding
Bearer Tokens and Privileged MCP Operations Transmitted over Plaintext HTTP
- Content
View full analysis
Vulnerability Details
File Location:
skill.json, lines 7-14
Vulnerability Type: Plaintext transmission of bearer credentials and authenticated operations
Risk Level: HighVulnerable Code
json "mcp": { "transport": "http", "url": "http://43.160.247.46:8090/mcp/call", "sse_url": "http://43.160.247.46:8090/sse", "auth": { "type": "bearer", "header": "Authorization", "token_prefix": "", "acquire_url": "http://43.160.247.46:3000" } },Technical Analysis
The machine-readable Skill configuration sends bearer-authenticated MCP requests and authorization traffic to a bare IP address over unencrypted HTTP. HTTP provides neither transport confidentiality nor reliable server authentication. An attacker able to observe or modify network traffic can therefore capture authorization headers, tamper with MCP requests and responses, or impersonate the configured service.
This configuration also materially contradicts the documented configuration in
skill.md, which identifieshttps://zmg-mcp.cztv.comas the MCP and token-acquisition origin. Clients are expected to execute the configuration fromskill.json, so the secure endpoint shown in the documentation does not mitigate the insecure runtime configuration.The affected MCP interface exposes account-bound capabilities, including private message retrieval, user-content retrieval, content publication, and irreversible article deletion. Consequently, interception of the bearer token could expose more than public browsing functionality.
Attack Path
- A user authorizes the Skill and configures or receives a valid bearer token.
- The Skill client follows
skill.jsonand connects to43.160.247.46using plaintext HTTP. - An attacker with a suitable network position, such as control of an untrusted access point, compromised router, proxy, or upstream network segment, observes or modifies the connection.
...[truncated 1190 chars]
- Remediation
View remediation
Remediation Suggestions
- Replace all plaintext MCP and authorization endpoints with the documented HTTPS origin:
https://zmg-mcp.cztv.com/sse- An HTTPS MCP call endpoint under the same authenticated domain
https://zmg-mcp.cztv.comfor token acquisition
- Enforce TLS certificate-chain and hostname validation. Do not permit fallback to plaintext HTTP or bypass certificate errors.
- Use a stable domain name rather than a bare IP so clients can authenticate the intended service through its TLS certificate.
- Reconcile
skill.jsonwith both documentation files so the transport, URLs, and token-prefix behavior are consistent. - Revoke and rotate any bearer tokens that may already have been transmitted through the plaintext endpoints.
- Issue short-lived, narrowly scoped tokens and bind them to the minimum capabilities required by the requested operation.
- Require explicit user confirmation immediately before publication and irreversible deletion, and enforce authorization checks on the server rather than relying only on Skill instructions.
- Add automated validation that rejects release artifacts containing non-HTTPS authentication, MCP, SSE, publication, or deletion endpoints.
- Replace all plaintext MCP and authorization endpoints with the documented HTTPS origin: