T09 · Insecure Skill Coding Practices
- Location
scripts/weather_query.py:52- Finding
Weather Data Retrieved over Unencrypted HTTP
- Content
View full analysis
Vulnerability Details
File Location:
scripts/weather_query.py, lines 52–54
Vulnerability Type: Unauthenticated and unencrypted network transport
Risk Level: MediumVulnerable Code
python url = f"http://d1.weather.com.cn/weather_index/{code}.html" req = urllib.request.Request(url) req.add_header('Referer', 'http://www.weather.com.cn/')Technical Analysis
The skill retrieves weather information over plain HTTP. HTTP provides neither transport encryption nor server authentication, so an attacker with a network interception position can observe and modify the response.
The application parses the received response without cryptographic authenticity verification. Consequently, an attacker can return syntactically valid content containing falsified current conditions, forecasts, air-quality measurements, life-index guidance, or weather alerts. These values are then emitted through formatted text or JSON output.
Attack Path
- A user or agent invokes the skill for a supported city or nine-digit weather code.
- The script requests
http://d1.weather.com.cn/weather_index/{code}.html. - An attacker controlling or monitoring an intermediate network component intercepts the HTTP exchange.
- The attacker replaces relevant response variables with valid, attacker-selected JSON data.
parse_weather()accepts the modified fields.- The manipulated data is displayed to the user or passed to a downstream agent through JSON output.
Exploitation requires an on-path position or control of an intermediary such as a malicious access point, compromised router, proxy, or DNS/network infrastructure.
Impact Assessment
The issue does not directly grant local code execution, filesystem access, elevated privileges, or persistence. Its scope is the integrity and confidentiality of the network exchange.
An attacker can falsify safety-relevant information, including severe-weather warnings, rainfall, visibility, temperature, AQI, and tr ...[truncated 186 chars]
- Remediation
View remediation
Remediation Suggestions
- Replace the plain HTTP endpoint with an HTTPS endpoint supplied by the data provider:
python url = f"https://d1.weather.com.cn/weather_index/{code}.html" req = urllib.request.Request(url) req.add_header("Referer", "https://www.weather.com.cn/") - Retain normal TLS certificate and hostname verification, and do not introduce unverified SSL contexts.
- Fail closed when TLS validation fails rather than retrying over HTTP.
- If the provider does not support HTTPS for this API, migrate to a trustworthy weather API that does.
- Where data integrity is safety-critical, consider an authenticated API response or provider-supported signature verification.
- Add tests or static checks that reject outbound plain HTTP URLs except for explicitly documented local development endpoints.
- Replace the plain HTTP endpoint with an HTTPS endpoint supplied by the data provider: