T09 · Insecure Skill Coding Practices
- Location
SKILL.md:60- Finding
Plaintext HTTP Used for Cryptocurrency Data and Payment Operations
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 60–61 and 80–81
Vulnerability Type: Unencrypted network communication
Risk Level: HighVulnerable Code
markdown ## Live Nodes - `http://212.56.43.191:9333` — anvil-prime - `http://212.56.43.191:9334` — anvil-onebash curl -s "http://212.56.43.191:9333/data?topic=oracle:rates:bsv&limit=1" | jq '.envelopes[0].payload | fromjson | .USD'Technical Analysis
The documented live nodes and example request use plaintext HTTP. HTTP provides neither transport encryption nor server authentication. An attacker with a suitable network position can observe or modify responses and requests without detection at the transport layer.
This is particularly significant because the Skill describes retrieving financial oracle data, transaction verification material, HTTP 402 pricing, payment addresses, and submitting payment proofs. Although the service may return signed envelopes or SPV material, the Skill does not instruct the user or agent to authenticate all security-sensitive fields before acting on them. In particular, an HTTP 402 payment address or endpoint pricing could be replaced in transit.
Using a bare IP address over HTTP also provides no certificate-bound identity for the advertised node.
Attack Path
- A user or agent follows the Skill and connects to one of the advertised HTTP nodes.
- An attacker gains a network interception position, such as through a compromised router, malicious access point, ISP-level interception, or local network poisoning.
- The attacker intercepts the plaintext HTTP request or response.
- The attacker replaces oracle data, endpoint pricing, a payment address, transaction-verification material, or another service response.
- The user or agent accepts the modified response because HTTP provides no server authentication or integrity protection.
- The victim may send funds to an attacker-co ...[truncated 780 chars]
- Remediation
View remediation
Remediation Suggestions
- Remove plaintext HTTP endpoints from the Skill documentation.
- Require HTTPS for every discovery, data, transaction-verification, and payment endpoint.
- Use domain names with valid certificates rather than unauthenticated bare-IP HTTP services.
- Preserve certificate verification in
curl; do not recommend--insecureor equivalent options. - Authenticate the node manifest and all security-sensitive response fields at the application layer.
- Cryptographically verify signed data envelopes, including the publisher key, signature, timestamp, topic, and expiration time, before using their contents.
- Validate SPV proofs independently against trusted and synchronized block headers.
- Bind HTTP 402 payment information to an authenticated service identity and verify the amount, destination address, network, endpoint, and request context before signing.
- Require explicit user confirmation before creating or broadcasting any payment transaction.
- Design payment proofs as endpoint-bound, request-bound, short-lived, and non-replayable.