T09 · Insecure Skill Coding Practices
Error
- Location
- SKILL.md:25
- Finding
- Unauthenticated Knowledge-Base Operations over Plaintext HTTP## Vulnerability Details **File Location**: `SKILL.md:25-58` **Additional Affected Locations**: `obsidian_kb.py:17-109`, `__init__.py:14-100`, `obsidian_tools.sh:6-104` **Vulnerability Type**: Plaintext transmission and missing client authentication **Risk Level**: High The documented API operations use plaintext HTTP and provide no authentication token, API key, client certificate, or authorization header. ```bash curl -s -X POST http://192.168.18.15:5000/api/note \ -H "Content-Type: application/json" \ -d '{ "title": "笔记标题", "content": "# 内容\n\n正文...", "tags": ["标签1", "标签2"] }' ``` ```bash curl -s -X POST http://192.168.18.15:5000/api/search \ -H "Content-Type: application/json" \ -d '{"query": "搜索内容"}' ``` ```bash curl -s "http://192.168.18.15:5000/api/note?file=笔记文件名.md" curl -s http://192.168.18.15:5000/api/notes curl -s http://192.168.18.15:5000/api/stats curl -s -X POST http://192.168.18.15:5000/api/build ``` The Python implementations exhibit the same behavior. For example: ```python def __init__(self, api_url="http://192.168.18.15:5000"): self.api_url = api_url self.base_url = f"{api_url}/api" ``` ```python response = requests.post(f"{self.base_url}/note", json=data, headers={"Content-Type": "application/json"}) ``` ### Technical Analysis Plaintext HTTP provides neither confidentiality nor server authenticity. An attacker with access to the relevant network path can inspect note contents, filenames, search terms, and operational metadata. A network-positioned attacker may also modify API responses or submitted notes. The client sends no credentials or authorization information. The project documentation also describes the knowledge base as shared across agents without cross-host query restrictions. Consequently, any party able to reach the API may be able to invoke the same read, write, ...[truncated 2050 chars]
- Remediation
- ## Remediation Suggestions 1. Replace plaintext HTTP with HTTPS and enforce certificate verification in all Python, shell, and documentation examples. 2. Require authenticated access using short-lived tokens, mutual TLS, or another centrally managed mechanism. 3. Apply per-agent authorization and separate read, write, listing, and index-administration permissions. 4. Restrict the service through host firewalls, network segmentation, and an authenticated reverse proxy. Do not treat private IP addressing as an access-control mechanism. 5. Bind the API only to required interfaces and explicitly allowlist authorized clients. 6. Protect sensitive notes with additional storage-level access controls and audit all reads, writes, and index-management actions. 7. Validate and sanitize note titles, folder names, filenames, and content on the server. 8. Make the API endpoint configurable rather than hard-coded, while rejecting non-HTTPS production endpoints. 9. Rotate any credentials introduced during remediation and monitor for prior unauthorized knowledge-base changes.