T09 · Insecure Skill Coding Practices
- Location
scripts/client.js:11- Finding
Compute Gateway Bearer Token Can Be Transmitted over Plaintext HTTP
- Content
View full analysis
Vulnerability Details
File Location:
scripts/client.js:11-28
Vulnerability Type: Missing HTTPS protocol enforcement
Risk Level: Mediumjs const baseUrl = process.env.MCP_COMPUTE_URL; const apiKey = process.env.MCP_COMPUTE_API_KEY; function assertEnv() { if (!baseUrl) throw new Error('Missing MCP_COMPUTE_URL'); if (!apiKey) throw new Error('Missing MCP_COMPUTE_API_KEY'); } async function post(path, body) { assertEnv(); const url = new URL(path, baseUrl); const res = await request(url, { method: 'POST', headers: { 'content-type': 'application/json', 'authorization': `Bearer ${apiKey}` }, body: JSON.stringify(body ?? {}) });The same unrestricted URL construction and bearer-token transmission pattern is also used by the PUT, GET, and DELETE helpers at
scripts/client.js:38-110.Technical Analysis
The documentation states that the private compute gateway is contacted over HTTPS, but
assertEnv()only verifies thatMCP_COMPUTE_URLandMCP_COMPUTE_API_KEYare present. It does not require the parsed URL to use thehttps:protocol.If
MCP_COMPUTE_URLis configured with anhttp://URL, the client sends the bearer token and request contents without transport encryption. Sensitive contents can include command strings, command environment values, session information, and uploaded or downloaded artifacts.Attack Path
- A user, deployment script, compromised configuration source, or social-engineering instruction supplies an
MCP_COMPUTE_URLbeginning withhttp://. assertEnv()accepts the value because it only checks whether it is non-empty.- The client creates requests to the plaintext endpoint and includes
Authorization: Bearer ${apiKey}. - An attacker with a network position between the client and gateway intercepts the bearer token and sensitive request or response data.
- The attacker reuses the token ...[truncated 455 chars]
- A user, deployment script, compromised configuration source, or social-engineering instruction supplies an
- Remediation
View remediation
Remediation Suggestions
- Parse and validate the base URL once during initialization.
- Reject every protocol other than
https:. - If plaintext HTTP is necessary for local development, require an explicit opt-in flag and restrict its use to loopback addresses such as
127.0.0.1or::1. - Reject URLs containing embedded credentials.
- Add tests confirming that
http://, malformed URLs, and unsupported protocols are rejected before any request is made. - Preserve normal TLS certificate verification and document that disabling certificate validation is unsupported.
Example hardening:
js function getValidatedBaseUrl() { if (!baseUrl) throw new Error('Missing MCP_COMPUTE_URL'); if (!apiKey) throw new Error('Missing MCP_COMPUTE_API_KEY'); const parsed = new URL(baseUrl); if (parsed.protocol !== 'https:') { throw new Error('MCP_COMPUTE_URL must use HTTPS'); } if (parsed.username || parsed.password) { throw new Error('MCP_COMPUTE_URL must not contain embedded credentials'); } return parsed; }