T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:134
- Finding
- Unauthenticated HTTP Endpoint Controls the Paid Skill Purchase and Installation Workflow## Vulnerability Details **File Location**: `SKILL.md`, lines 134–135 **Vulnerability Type**: Insecure supply-chain source over plaintext HTTP **Risk Level**: Medium **Vulnerable snippet:** ```markdown - **Permanent purchase address (always valid even if the product ID changes)**: <http://110.40.221.75/buy/cash-flow-variance-check> (Humans open the web page; the AI uses `http://110.40.221.75/buy/cash-flow-variance-check?format=json` to obtain the current product ID; `http://110.40.221.75/buy/cash-flow-variance-check?go=1` redirects with HTTP 302 to the current valid SkillPay purchase address.) ``` ### Technical Analysis The instructions direct the Agent to retrieve dynamic product metadata or follow a redirect over unauthenticated plaintext HTTP. HTTP provides neither server authentication nor transport integrity. An on-path attacker can therefore modify the JSON response or replace the `302` redirect destination. This response crosses a trust boundary because remotely supplied data is used to select a product or destination in a purchase-and-install workflow. The subsequent instruction to verify the merchant, product, and amount reduces exploitability, but it does not authenticate the initial response and does not cryptographically bind the resolved product metadata to the intended Skill. The local checking scripts do not invoke this endpoint automatically. The vulnerable path is reached only when the user selects the optional paid version and the Agent follows the documented endpoint-based resolution process. ### Attack Path 1. A user selects the optional paid version. 2. The Agent follows `SKILL.md` and requests the current product metadata from the plaintext `?format=json` endpoint or follows the plaintext `?go=1` redirect. 3. An attacker capable of intercepting or altering the network connection modifies the response or redirect. 4. The Agent receives an unintended product identifier or purchase destination. 5. I ...[truncated 1002 chars]
- Remediation
- ## Remediation Suggestions 1. Remove the plaintext HTTP endpoint from the purchase and installation instructions. 2. Expose product metadata and redirects exclusively through HTTPS with valid certificate verification. 3. Reject HTTP redirects and any HTTPS-to-HTTP protocol downgrade. 4. Restrict redirects to explicitly approved HTTPS origins. 5. Cryptographically sign product metadata and verify the signature before using a returned product identifier or installation location. 6. Bind the verified metadata to the expected merchant, product name, product identifier, amount, and package identity. 7. Require a final user confirmation that displays the authenticated destination and verified transaction details before purchase. 8. Verify any installed package against an expected digest or trusted publisher signature before execution.