T09 · Insecure Skill Coding Practices
Warning
- Location
- ship-position/SKILL.md:96
- Finding
- HiFleet Authentication Token Exposed in URL Query String<![CDATA[ ## Vulnerability Details **File Location**: `ship-position/SKILL.md`, lines 96-107 and 115-116 **Vulnerability Type**: Credential exposure through URL query parameters **Risk Level**: Medium ### Vulnerable Code ```text ## 调用流程 / Call Flow 1. **检查 token**：若未配置 `usertoken`，返回提示并终止。 2. **校验 MMSI**：请求必须包含有效 `mmsi`（9 位数字字符串）。 3. **发起请求**：`GET https://api.hifleet.com/position/position/get/token?mmsi={mmsi}&usertoken={usertoken}` 4. **解析结果**：根据 `result === "ok"` 与 `list` 解析位置与船舶信息；若 `result !== "ok"`，按错误处理并提示用户。 ``` The usage example repeats the insecure construction: ```text # 获取 MMSI 413829443 的最新船位 GET https://api.hifleet.com/position/position/get/token?mmsi=413829443&usertoken=${HIFLEET_USER_TOKEN} ``` ### Technical Analysis The Skill directs the agent to place the HiFleet authentication token in a GET request's query string. Although HTTPS encrypts the URL while it is in transit, it does not prevent the complete URL from being recorded at endpoints or intermediary infrastructure. Query strings can be captured by: - HTTP client debug and request logs - Reverse-proxy and API-gateway access logs - Monitoring, tracing, and telemetry systems - Error reports and exception traces - Agent tool-call histories - Shell history or copied request examples - Support diagnostics containing completed request URLs Therefore, a secret that grants API access can spread into systems whose access controls and retention policies are weaker than those of a dedicated credential store. The Skill does not instruct implementations to redact the `usertoken` value from these channels. ### Attack Path 1. A user configures a valid HiFleet token through an environment variable, project configuration, or request parameter. 2. The Skill constructs a URL containing the token as `usertoken={usertoken}`. 3. The HTTP client, agent runtime, proxy, telemetry platform, or error-reporting system records the complete requ ...[truncated 968 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Prefer an authentication header, such as `Authorization: Bearer <token>`, if the HiFleet API supports one. 2. If the provider requires `usertoken` as a query parameter: - Configure the HTTP client and agent runtime to redact the parameter value from request logs, traces, exceptions, and tool-call output. - Never display or return the completed URL to users. - Disable verbose HTTP logging in production. - Configure proxies, gateways, and observability systems to remove or mask `usertoken`. - Avoid placing completed requests in shell history or persistent request collections. 3. Store the token only in an approved secret manager or protected environment variable. Do not store it in source-controlled project configuration. 4. Use short-lived, least-privilege tokens restricted to the required vessel-position endpoint where supported. 5. Document token rotation and revocation procedures, and rotate any token suspected of appearing in logs. 6. Add automated tests that verify URLs, errors, and diagnostic output contain a redacted value such as `usertoken=[REDACTED]` rather than the credential. ]]>