T09 · Insecure Skill Coding Practices
Warning
- Location
- SKILL.md:23
- Finding
- Weather API Uses Unencrypted HTTP Transport## Vulnerability Details **File Location**: `SKILL.md`, line 23 **Vulnerability Type**: Plaintext API transport **Risk Level**: Medium **Vulnerable code snippet:** ```markdown ## API Base http://100.102.77.110:8012 ``` ### Technical Analysis The skill configures all weather operations to use an API base URL with plaintext HTTP rather than HTTPS. Application-layer encryption and server authentication are therefore absent. Requests may contain field identifiers, farm coordinates, date ranges, and operational context, while responses may include forecasts and spray-condition evaluations used to make farming decisions. The address belongs to the shared-address range commonly used by private overlay networks. Such an overlay may encrypt traffic at the network layer, but that protection is not established by this project and does not replace authenticated HTTPS at the application layer. A compromised peer, improperly configured route, hostile proxy, or attacker positioned inside the trusted network could potentially observe or modify the traffic. ### Attack Path 1. The agent loads the documented API base URL and constructs a weather request over HTTP. 2. An attacker obtains a network position capable of observing or modifying traffic, such as control of a trusted peer, route, gateway, or proxy. 3. The attacker intercepts farm identifiers, coordinates, dates, or other operational query data. 4. The attacker can modify an HTTP response to report false temperature, precipitation, wind, forecast, or spray-condition information. 5. The agent treats the altered response as service output and may present inaccurate operational guidance to the user. This exploitation path requires access to the relevant network path or trusted overlay environment; the file alone does not grant such access. ### Impact Assessment No local system privileges are directly obtained through this flaw. Its primary effects are: - **Confidentiality ...[truncated 560 chars]
- Remediation
- ## Remediation Suggestions 1. Replace the HTTP endpoint with an HTTPS service hostname: ```markdown ## API Base https://weather.internal.example:8012 ``` 2. Configure a valid certificate issued by a trusted internal or public certificate authority and require normal certificate and hostname validation. 3. Reject TLS certificate errors rather than allowing insecure fallback behavior. 4. Prohibit redirects or automatic downgrade from HTTPS to HTTP. 5. Add authenticated API access where appropriate, using narrowly scoped and securely stored credentials rather than embedding secrets in `SKILL.md`. 6. Apply network access controls so only authorized agents and service hosts can reach the weather API. 7. If a private overlay network is required, retain its encryption but use HTTPS as an additional application-layer control. 8. Document connection timeouts, response validation, and failure behavior so manipulated or malformed responses are not silently treated as trustworthy weather data.