T09 · Insecure Skill Coding Practices
Error
- Location
README.md:121- Finding
Dashboard Authentication Token Exposed Through Plaintext URLs
- Content
View full analysis
/tmp/dashboard.log 2>&1 & # Open the port in the system firewall ufw allow 8765 # or: firewall-cmd --add-port=8765/tcp ``` The authentication token is also placed in an API query string: ```bash curl http://localhost:8765/api/stats?token=YOUR_TOKEN ``` ### Technical Analysis The documentation recommends authenticating to the dashboard by placing its token in a URL query parameter. Query parameters are commonly retained in browser history, copied into screenshots, recorded by web servers and reverse proxies, and exposed through diagnostic logs. Depending on browser and referrer policy, they may also be disclosed through outbound referral metadata. The recommended remote-access configuration binds the dashboard to `0.0.0.0`, opens TCP port 8765, and uses plaintext HTTP. Plaintext transport provides neither confidentiality nor integrity. A network-positioned attacker could observe the token or modify traffic. Binding to all interfaces also exceeds the minimum privileges necessary for the declared local dashboard functionality. The risk is amplified by the dashboard's documented access to memories, task records, skills, user prompts, and generated responses. ### Attack Path ...[truncated 1198 chars]- Remediation
View remediation