T09 · Insecure Skill Coding Practices
Error
- Location
skill.md:115- Finding
Misleading end-to-end encryption claim while examples transmit document plaintext to the service
- Content
View full analysis
All content is end-to-end encrypted, so losing your keys means permanently losing access to the document. Additional write operations likewise submit Markdown directly: ```bash curl -X PUT https://api.molt-md.com/api/v1/docs/123e4567-e89b-12d3-a456-426614174000 \ -H "X-Molt-Key: abcd1234_base64_encoded_key_xyz" \ -H "Content-Type: text/markdown" \ -H "If-Match: \"v1\"" \ -d "# Updated Document This is the new content." ``` ### Technical Analysis The documented API examples send document content as ordinary JSON or `text/markdown` request bodies. HTTPS protects content in transit from passive network observers, but the TLS endpoint receives the plaintext. No client-side encryption operation, authenticated ciphertext format, nonce generation, or local decryption step is documented. Consequently, the examples do not substantiate the declared end-to-end encryption property. At most, the remote service may perform server-side encryption after receiving plaintext. Server-side encryption does not prevent the service operator, a compromised API server, request logging middleware, or backend instrumentation from accessing document content. Network transmission is inherent to the declared cloud-collaboration functionality. However, sending potentially sensitive persistent notes, agent state, reports, and project context in plaintext to the ser ...[truncated 1383 chars]- Remediation
View remediation