T09 · Insecure Skill Coding Practices
- Location
SKILL.md:94- Finding
Hardcoded qBittorrent Credentials Transmitted over Plaintext HTTP
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 94–96 and 109–117
Vulnerability Type: Hardcoded credentials, plaintext credential transmission, and insecure session-cookie handling
Risk Level: HighVulnerable Code
markdown ### 7. 添加到qBittorrent - qBittorrent地址：192.168.1.38:8085 - 账号：boring737 - 密码：Conan2015bash # 登录qBittorrent curl -s -c cookies.txt -X POST "http://192.168.1.38:8085/api/v2/auth/login" \ -d "username=boring737&password=Conan2015" # 添加种子 curl -s -b cookies.txt -X POST "http://192.168.1.38:8085/api/v2/torrents/add" \ -F "torrent_file=@/tmp/xxx.torrent" \ -F "savepath=/volume1/EMBY/downloads/tv"Technical Analysis
A reusable qBittorrent username and password are embedded directly in the Skill documentation. Anyone able to read the package can recover these credentials without further access or reverse engineering.
The prescribed login request uses unencrypted HTTP. Consequently, the credentials and subsequent authenticated traffic lack transport confidentiality and server authentication. An attacker capable of observing or manipulating traffic on the relevant network could capture the credentials, steal the authenticated session, or alter requests in transit.
The command also writes the authenticated cookie to the relative path
cookies.txt. It does not establish restrictive file permissions, use a securely created temporary file, or remove the cookie after use. Depending on the working directory and host permissions, another local user or process could recover and reuse that session.Attack Path
- An attacker obtains read access to the Skill package or a copy of
SKILL.md. - The attacker extracts the qBittorrent endpoint, username, and password from lines 94–96 or 111–112.
- If the attacker can reach
192.168.1.38:8085, they submit the exposed credentials to the qBittorrent authentication API. - After authentication, the a ...[truncated 1118 chars]
- An attacker obtains read access to the Skill package or a copy of
- Remediation
View remediation
Remediation Suggestions
- Immediately rotate the exposed qBittorrent password and invalidate existing authenticated sessions.
- Remove the username and password from
SKILL.md, examples, source control history, logs, and distributed package copies. - Retrieve credentials at runtime from a protected secret manager or environment-based secret injection mechanism. Do not print them or place them directly in command-line examples.
- Configure qBittorrent behind HTTPS and require certificate validation. Do not send credentials or authenticated requests over plaintext HTTP, even on a private network.
- Create a dedicated least-privileged account limited to the operations and storage paths required by this Skill.
- Create cookie files securely with restrictive permissions, preferably in a private runtime directory. For example, set
umask 077, use a securely generated temporary filename, and delete it immediately after the operation. - Restrict access to the qBittorrent API through host firewall rules or network segmentation so that only authorized clients can reach it.
- Avoid embedding user-specific addresses and credentials in reusable Skill packages. Use documented configuration placeholders and validate that required values are supplied securely at runtime.
- Review qBittorrent activity and relevant network logs for unauthorized authentication or torrent changes made using the exposed account.