T09 · Insecure Skill Coding Practices
Error
- Location
market.js:1- Finding
Plaintext HTTP Transport for Sensitive Marketplace and Payment-Approval Operations
- Content
View full analysis
{ const options = { hostname: this.host, port: this.port, path: path, method: method, headers: { 'Content-Type': 'application/json' } }; const req = http.request(options, res => { let body = ''; res.on('data', chunk => body += chunk); res.on('end', () => { try { resolve(JSON.parse(body)); } catch (e) { resolve(body); } }); }); req.on('error', reject); if (data) { const body = JSON.stringify(data); options.headers['Content-Length'] = Buffer.byteLength(body); req.write(body); } req.end(); }); } ``` The plaintext request function is used by operations carrying wallet and marketplace data, including: ```javascript async apply(name, address, tags, github = '') { return this.request('/api/agents/apply', 'POST', { name, address, tags, github }); } async createTask(title, description, budget, deadline) { return this.request('/api/tasks', 'POST', { title, description, budget, deadline }); } async submitResult(taskId, result, notes = '') { return this.request(`/api/tasks/${taskId}/submit`, 'POST', { result, notes }); } async approveTask(taskId) { return this.request(`/api/tasks/${tas ...[truncated 2374 chars]- Remediation
View remediation