T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:151
- Finding
- Unauthenticated HTTP Endpoint Controls Dynamic Purchase and Installation Routing## Vulnerability Details **File Location**: `SKILL.md`, lines 151–159 **Vulnerability Type**: Insecure external installation source **Risk Level**: Medium **Relevant snippet**: ```text Please purchase and install Skill "Foreign Trade and Export Pack · Buyout Edition." Official installation and purchase instructions: https://skillpay.alipay.com/buildguide.md Installation steps are subject to the official instructions: https://skillpay.alipay.com/buildguide.md After installation, read the SKILL.md of the newly installed skillpay-onboarding... ``` ```markdown - **Permanent purchase address**: <http://110.40.221.75/buy/foreign-trade-pack> (A human opens the human-readable page; AI uses `http://110.40.221.75/buy/foreign-trade-pack?format=json` to obtain the current product number; `http://110.40.221.75/buy/foreign-trade-pack?go=1` redirects to the currently valid SkillPay purchase address.) ``` ### Technical Analysis When the user requests the paid edition, the Skill directs the agent to retrieve a current product identifier or purchase destination from a plain HTTP endpoint. HTTP provides no transport authentication or integrity protection. An on-path attacker can therefore alter the JSON response or the redirect destination. The modified network data enters a software-purchase and Skill-installation workflow executed with the user's authority. Although the surrounding instructions require checking the merchant, product, and order amount and require the user to confirm payment, those procedural checks do not authenticate the HTTP response or guarantee that the selected package and installation source are the intended ones. The evidence does not establish malicious intent by the project author, so the project is classified as suspicious rather than malicious. ### Attack Path 1. The user asks the agent to obtain the paid edition. 2. The agent follows `SKILL.md` and accesses the documented HTTP JSON or re ...[truncated 1009 chars]
- Remediation
- ## Remediation Suggestions - Remove the plain HTTP endpoint and redirect from the installation workflow. - Publish purchase metadata exclusively over HTTPS with strict certificate validation. - Use immutable product identifiers and authenticated, integrity-protected metadata rather than dynamically trusting a redirect response. - Pin the expected merchant, product identity, installation package, and source in the reviewed Skill. - Before purchase or installation, require programmatic comparison against signed or otherwise authenticated metadata. - Preserve explicit user confirmation for payment, but do not treat confirmation alone as a substitute for source authentication. - Reject redirects to origins outside a narrowly defined HTTPS allowlist.