T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:36- Finding
Malformed Authorization Header in Marketplace Listing Request
- Content
View full analysis
; Content-Type: application/json ``` It does not emit a valid standalone `Content-Type` header. This conflicts with the authentication instructions elsewhere in the file and makes the behavior of a financially consequential marketplace operation unreliable. The hardcoded request body also demonstrates a concrete asset identifier and price without requiring the user or agent to confirm those values immediately before submission. ### Attack Path 1. A user or agent follows the documented create-listing example. 2. The shell expands `$LISTING_ID` and sends it as authorization data instead of using `$CSFLOAT_API_KEY`. 3. The request reaches the CSFloat listing endpoint with malformed authentication and no proper JSON content-type header. 4. The API will ordinarily reject the request; if an intermediary or future API implementation parses malformed headers permissively, the request could be interpreted inconsistently. 5. If the authentication error is corrected without also adding transaction confirmation, an agent may submit the hardcoded asset and price values without validating the intended listing parameters. No direc ...[truncated 907 chars]- Remediation
View remediation