T09 · Insecure Skill Coding Practices
Warning
- Location
- SKILL.md:22
- Finding
- Bearer Token May Be Transmitted over Plaintext HTTP## Vulnerability Details **File Location**: `SKILL.md:22-27` and `references/agent-api.md:7-24` **Vulnerability Type**: Plaintext transmission of a bearer token **Risk Level**: Medium ### Vulnerable Code From `SKILL.md:22-27`: ```bash OPENCLAW_AGENT_API_BASE_URL=http://your-host:8080/api/v1/agent OPENCLAW_AGENT_API_KEY=your-own-bearer-token ``` From `references/agent-api.md:7-24`: ```bash OPENCLAW_AGENT_API_BASE_URL=http://your-host:8080/api/v1/agent OPENCLAW_AGENT_API_KEY=your-own-bearer-token ``` ```text - send `Authorization: Bearer $OPENCLAW_AGENT_API_KEY` - treat `OPENCLAW_AGENT_API_BASE_URL` as the canonical base path ``` ### Technical Analysis The documented configuration uses an `http://` API URL while directing the agent to transmit the API key as a bearer credential in the HTTP `Authorization` header. Plain HTTP provides neither transport confidentiality nor authenticated server identity. If the configured host is remote or traffic crosses an untrusted network, an attacker with a suitable network position could inspect or modify requests. Because bearer tokens are usable by possession, interception may allow immediate credential replay without knowledge of an additional secret. The issue is configuration-dependent: use of a loopback address or a separately secured trusted tunnel would reduce exposure. However, the example uses the generic remote-looking hostname `your-host` and does not restrict plaintext HTTP to loopback connections. ### Attack Path 1. A user follows the documented example and configures a non-loopback API endpoint using `http://`. 2. The skill calls the endpoint and sends `Authorization: Bearer $OPENCLAW_AGENT_API_KEY`. 3. Traffic traverses a network observable or controllable by an attacker. 4. The attacker captures the bearer token or redirects/modifies the plaintext API exchange. 5. The attacker replays the token against the decision-support API or supplies manipulated market-analysis responses. ### Impact Assessment ...[truncated 555 chars]
- Remediation
- ## Remediation Suggestions 1. Require `https://` for every non-loopback API endpoint. 2. Replace the generic plaintext example with an HTTPS example: ```bash OPENCLAW_AGENT_API_BASE_URL=https://your-host.example/api/v1/agent OPENCLAW_AGENT_API_KEY=your-own-bearer-token ``` 3. If plaintext HTTP is needed for local development, explicitly restrict it to loopback addresses such as `http://127.0.0.1:8080` or `http://localhost:8080`. 4. Validate the configured URL before issuing requests and reject `http://` when the host is not loopback. 5. Use TLS certificate validation and do not permit insecure certificate bypasses. 6. Issue short-lived, narrowly scoped, read-only tokens and support prompt revocation and rotation. 7. Ensure the backend token cannot access trading, wallet, administrative, or unrelated endpoints. 8. Document trusted tunnels or mutually authenticated TLS for deployments that cannot expose HTTPS directly. 9. Apply the same changes consistently in both `SKILL.md` and `references/agent-api.md`.