T09 · Insecure Skill Coding Practices
Error
- Location
bridge_server.py:151- Finding
Unauthenticated Network Endpoint Can Invoke the Main Agent
- Content
View full analysis
tuple[bool, str, str]: normalized = normalize_text(text) if not normalized: return False, 'empty_text', '' matched_subagent = detect_named_subagent(text) if source != 'xiaoai-speaker': return True, 'non_xiaoai_source', matched_subagent has_target = any(target in normalized for target in BRIDGE_WHITELIST_TARGETS) has_verb = any(verb in normalized for verb in BRIDGE_WHITELIST_VERBS) direct_target = any(normalized.startswith(target) for target in BRIDGE_WHITELIST_TARGETS) if has_target and (has_verb or direct_target): return True, 'matched_bridge_whitelist', matched_subagent return False, 'not_in_bridge_whitelist', matched_subagent ``` ```python length = int(self.headers.get('Content-Length', '0')) body = self.rfile.read(length) if length > 0 else b'{}' payload = json.loads(body.decode('utf-8') or '{}') text = str(payload.get('text', '')).strip() source = str(payload.get('source', 'xiaoai-speaker')).strip() or 'xiaoai-speaker' ``` ```python server = HTTPServer((HOST, PORT), Handler) server.serve_forever() ``` ### Technical Analysis The bridge listens on every network interface through `0.0.0.0` but does not require a bearer token, HMAC signature, client certificate, or other authentication. Consequently, any client that can reach TCP port 8765 can submit text to the bridge. The `source` value is also entirely client-controlled. The forwarding function automatically approves every nonempty request where `source` is not exactly `xiaoai-speaker`. This allows a remote client to bypass the XiaoAI whitel ...[truncated 1939 chars]- Remediation
View remediation