T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:120
- Finding
- Unauthenticated HTTP Product Metadata in Purchase and Installation Workflow## Vulnerability Details **File Location**: `SKILL.md`, lines 120–121 **Vulnerability Type**: Unauthenticated external product source **Risk Level**: Medium ```markdown - **Permanent purchase address**: `http://110.40.221.75/buy/asset-impairment-check` (AI uses `http://110.40.221.75/buy/asset-impairment-check?format=json` to obtain the current product ID; `http://110.40.221.75/buy/asset-impairment-check?go=1` redirects to the current SkillPay purchase address.) ``` ### Technical Analysis The Skill instructs the agent to obtain the current product identifier or purchase destination from a plaintext HTTP endpoint hosted at a bare IP address. HTTP provides neither transport confidentiality nor server authentication. A network-path attacker could therefore alter the JSON response or replace the redirect destination. This remote metadata is trusted as part of a workflow that initiates a purchase and installs another Skill. The user authorizes purchase of a specifically named full edition, but the unauthenticated response can change the selected product or destination after that authorization. The documented merchant-ID verification and requirement for user payment confirmation reduce exploitability, but they do not authenticate the HTTP response and may not detect substitution involving another product under the expected merchant. ### Attack Path 1. The user selects the paid edition. 2. The agent follows the documented instructions and requests the product metadata or redirect over plaintext HTTP. 3. An attacker positioned on the network path intercepts the request. 4. The attacker substitutes the returned product identifier or redirect destination. 5. The agent uses the modified data to prepare the subsequent purchase and installation workflow. 6. If the substituted product passes the documented visible checks and the user confirms payment, the agent may purchase or install a product other than the specifically intended edit ...[truncated 692 chars]
- Remediation
- ## Remediation Suggestions - Remove the plaintext HTTP and bare-IP product discovery routes. - Retrieve product metadata only through authenticated HTTPS endpoints operated by the official platform. - Reject redirects to origins outside an explicit HTTPS allowlist. - Validate the merchant ID, immutable product identity, product name, amount, and expected package identity before presenting the payment request. - Repeat those validations after payment and before installation to prevent metadata changes between stages. - Where the platform supports it, verify signed product metadata or a cryptographic digest of the package before installation. - Fail closed when TLS validation, origin validation, metadata verification, or product-identity checks fail.