T09 · Insecure Skill Coding Practices
- Location
SKILL.md:43- Finding
Plaintext HTTP Used for Sensitive Document Upload and Processing
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md:43-56
Vulnerability Type: Plaintext transmission of potentially sensitive document data
Risk Level: HighVulnerable Code Snippet
markdown `document_url` 既可以是公网可访问的文件 URL，也可以是本地文件路径。 当传入本地路径时，工具会先上传到 DPA 文档里指定的文件服务，再调用字段抽取接口。 ### 环境变量 - `DPA_ENV`: `sim` 或 `prod`，默认 `sim` - `DPA_BASE_URL`: 可选，自定义覆盖解析服务地址 - `DPA_UPLOAD_URL`: 可选，自定义覆盖文件上传地址 默认端点： - 仿真环境：`http://imsfz.gjzq.cn:18087/ismp/yx-dpa/document` - 仿真上传：`http://imsfz.gjzq.cn:18087/ismp/yx-gw/infras/file/file/v3/upload` - 生产环境：`http://ims.gjzq.cn:18087/ismp/yx-dpa/document` - 生产上传：`http://ims.gjzq.cn:18087/ismp/yx-gw/infras/file/file/v3/upload`Technical Analysis
The skill documentation states that a document supplied through a local path is uploaded to a remote file service before extraction. All four documented default processing and upload endpoints use plaintext
http://rather than authenticated and encrypted HTTPS.Because HTTP does not provide transport confidentiality, integrity, or server authentication, an attacker with a suitable network position can inspect document contents and API messages. The attacker may also modify requests or responses in transit, redirect an upload, substitute extraction results, or impersonate the remote service.
The affected workflow is intended to process potentially sensitive material, including contracts, forms, financial reports, and local documents. Consequently, the exposed data may include the source document, extraction schema, extracted fields, provenance information, task identifiers, and service responses.
The configurable
DPA_BASE_URLandDPA_UPLOAD_URLvariables may further increase exposure if untrusted configuration can redirect processing to an attacker-controlled endpoint. The reviewed package contains only documentation and metadata, not the underlying tool implementation, so enforcement of TLS, certificate validation, endpoint restrictions, authentication, and r ...[truncated 1896 chars]- Remediation
View remediation
Remediation Suggestions
- Replace every default
http://endpoint with an authenticatedhttps://endpoint using modern TLS. - Reject plaintext HTTP endpoints at runtime, especially for document upload, task submission, polling, and result retrieval.
- Enable strict certificate and hostname verification. Do not permit insecure TLS modes or trust-all certificate handlers.
- Restrict
DPA_BASE_URLandDPA_UPLOAD_URLto an approved HTTPS allowlist. If arbitrary endpoints are required, display the destination and obtain explicit user approval before transmitting data. - Validate redirects and reject redirects to plaintext, untrusted, loopback, link-local, or private endpoints unless specifically authorized.
- Inform users clearly that local files leave the local system, identify the destination service, and obtain explicit consent before upload.
- Apply authentication and authorization to upload and extraction APIs, and avoid exposing credentials or sensitive task identifiers in URLs or logs.
- Add request integrity protections where appropriate and validate that returned results correspond to the submitted task and document.
- Minimize retained data, define deletion periods, and avoid logging document contents or extracted sensitive values.
- Add automated tests that fail when configured endpoints use plaintext HTTP or when certificate validation is disabled.
- Replace every default