T09 · Insecure Skill Coding Practices
Warning
- Location
- SKILL.md:1
- Finding
- Plaintext HTTP Endpoint Exposes WeChat Data and Messaging Operations to Network Interception## Vulnerability Details **File Location**: `SKILL.md`, lines 1-5 **Vulnerability Type**: Plaintext transmission of sensitive data and messaging operations **Risk Level**: Medium ### Vulnerable Code ```yaml name: wechat_operate description: 通过微信进行社交管理与消息发送。流程：查询目标（好友/群聊/成员） -> 确认目标 -> 发送内容（文本/图片/文件）。 endpoint: http://192.168.29.1:8080 env: WECHAT_APPID: wx_KcD1dMEn7KidBemwN2lVh ``` The configured endpoint is subsequently used for operations that query contacts and groups and send text, image, and file messages, including: ```markdown - `GET /aiTest/queryFriend` - `GET /aiTest/queryRecentContact` - `GET /aiTest/queryChatroom` - `GET /aiTest/queryChatroomMembers` - `POST /aiTest/sendText` - `POST /aiTest/sendImg` - `POST /aiTest/sendFile` ``` ### Technical Analysis The Skill configures its WeChat service through unencrypted HTTP. Requests to this endpoint may contain account identifiers, recipient identifiers, message content, image references, file URLs, and filenames. Responses may expose friends, recent contacts, group chats, group members, and their corresponding identifiers. HTTP does not provide transport confidentiality, server authentication, or message integrity. A network-adjacent attacker capable of observing or modifying traffic between the Agent and `192.168.29.1:8080` could read sensitive request and response data. An active attacker could also alter a contact-query response so that a displayed recipient resolves to an attacker-controlled `wxId`, or modify a message request after the user has confirmed it. The Skill documentation does not specify any application-layer authentication, signed requests, integrity checks, replay prevention, or independent validation of recipient identifiers. The user-confirmation workflow is a useful safeguard against accidental delivery, but it does not prevent traffic modification after confirmation. ### Attack Path 1. The Agent invokes a contact o ...[truncated 1552 chars]
- Remediation
- ## Remediation Suggestions 1. Replace the HTTP endpoint with HTTPS and require strict certificate validation. 2. Use a certificate issued for the service identity; where operationally appropriate, use mutual TLS to authenticate both the Agent and the service. 3. Require short-lived, scoped authentication credentials for every API request. Do not treat the WeChat application identifier as an authentication secret. 4. Add request integrity and replay protection, such as signed requests containing a timestamp, nonce, HTTP method, request path, and body digest. 5. Bind the recipient's displayed identity to the exact immutable recipient identifier included in the confirmed request. Reject any change between lookup, confirmation, and transmission. 6. Minimize returned contact and group data and enforce server-side authorization for each query and send operation. 7. Avoid exposing unrestricted or long-lived file URLs. Use short-lived, recipient-scoped URLs or upload files through an authenticated encrypted channel. 8. Store account-specific configuration outside the Skill document and provide it through a protected deployment configuration mechanism. 9. Log recipient substitutions, authentication failures, replay attempts, and message-send operations without recording sensitive message bodies or reusable credentials.