T09 · Insecure Skill Coding Practices
Warning
- Location
- SKILL.md:115
- Finding
- Unauthenticated HTTP Endpoint Controls Purchase Routing## Vulnerability Details **File Location**: `SKILL.md`, lines 115–116 **Vulnerability Type**: Unauthenticated transport for payment-routing data **Risk Level**: Medium ### Vulnerable Snippet ```markdown - **不变购买地址（永远有效，商品号变了也不用改）**：<http://110.40.221.75/buy/ap-factoring-check> （人打开是人看的页面；AI 用 `http://110.40.221.75/buy/ap-factoring-check?format=json` 拿当前商品号；`http://110.40.221.75/buy/ap-factoring-check?go=1` 直接 302 跳到当前有效的 SkillPay 购买地址。） ``` ### Technical Analysis The Skill instructs an agent to obtain a current product identifier from a plaintext HTTP JSON response or use a plaintext HTTP endpoint that issues a `302` redirect to a purchase destination. HTTP provides no server authentication or transport integrity. When the user selects the optional paid edition, a network-positioned attacker could alter the JSON response, replace the redirect target, or substitute the served purchase page. This promotes unauthenticated network data into trusted payment-routing instructions. The separate instruction to verify the merchant identifier, product identifier, order amount, and destination reduces risk but does not technically authenticate the HTTP response or enforce those checks. It therefore does not close the trust-boundary violation. ### Attack Path 1. The user chooses the optional paid edition. 2. The agent follows the documented HTTP endpoint to retrieve the current product identifier or purchase redirect. 3. An attacker with control over a network intermediary, proxy, gateway, or DNS/network path intercepts the plaintext request. 4. The attacker replaces the JSON product data or `302 Location` header with an attacker-controlled destination. 5. The agent presents or follows the substituted link as the current purchase route. 6. The user may be directed to a phishing or fraudulent payment page. ### Impact Assessment Exploitation does not grant direct local system privileges. It can, however, control the payment ...[truncated 402 chars]
- Remediation
- ## Remediation Suggestions - Remove the plaintext HTTP purchase and product-resolution endpoints. - Serve all purchase metadata and redirects exclusively over HTTPS with valid certificate verification. - Resolve purchases only through an authenticated, approved SkillPay origin. - Reject redirects to origins outside an explicit allowlist. - Do not rely on a mutable redirect endpoint as the sole source of product identity. - Before exposing a payment link, verify the merchant ID, product ID, amount, order identifier, and destination using authenticated platform data. - Require the user to confirm the verified transaction details before continuing. - Fail closed if TLS validation, origin validation, or transaction-detail verification fails.