T09 · Insecure Skill Coding Practices
Warning
- Location
- paipan.py:12
- Finding
- Personal Data Transmitted Over Unencrypted HTTP## Vulnerability Details **File Location**: `paipan.py:12, 43` **Vulnerability Type**: Plaintext transmission of sensitive personal data **Risk Level**: Medium The endpoint is also documented as insecure in `SKILL.md:42`. ```python API_ENDPOINT = "http://api.bagezi.top/api/paipan" ``` ```python payload = { "name": name, "gender": gender, "birthday_str": birthday_str, } response = requests.post(API_ENDPOINT, json=payload, timeout=TIMEOUT) ``` ```markdown - Latest endpoint: `http://api.bagezi.top/api/paipan` ``` ### Technical Analysis The CLI sends a user's name, gender, and complete birth timestamp to a remote API using plaintext HTTP. HTTP provides neither transport confidentiality nor server authentication and does not protect message integrity. An attacker with a network position—such as a malicious Wi-Fi operator, compromised router, ISP-level intermediary, or local network attacker capable of traffic interception—can inspect the submitted personal information. The attacker can also modify the request or API response in transit because the client has no authenticated TLS channel through which to verify the server or received content. ### Attack Path 1. A user runs the CLI and supplies their name, gender, and birth timestamp. 2. The application serializes those values into a JSON request body. 3. `requests.post` sends the body to `http://api.bagezi.top/api/paipan` without TLS. 4. A network-positioned attacker captures the HTTP traffic and reads the personal data. 5. The attacker may alter the outgoing request or substitute a forged API response. 6. The application accepts the modified response as originating from the intended service and prints it to the user. ### Impact Assessment Exploitation does not grant local operating-system privileges or code execution. Its scope is the confidentiality and integrity of data exchanged with the remote API. An attacker can obtain the submi ...[truncated 175 chars]
- Remediation
- ## Remediation Suggestions 1. Replace the endpoint with an HTTPS URL backed by a valid, trusted certificate: ```python API_ENDPOINT = "https://api.bagezi.top/api/paipan" ``` 2. Confirm that the service supports HTTPS and retains certificate verification. Do not set `verify=False`. 3. Prevent downgrade behavior: do not fall back to HTTP if TLS fails. 4. Ensure redirects cannot silently move sensitive requests to an HTTP destination, for example by validating the final destination and scheme or disabling redirects where they are unnecessary. 5. Update `SKILL.md` so all documented endpoints and examples use HTTPS. 6. Clearly disclose that the supplied personal data is sent to a third-party service and minimize the submitted fields where possible. 7. If the server cannot provide properly configured HTTPS, do not transmit personal information to it until secure transport is available.