T09 · Insecure Skill Coding Practices
Warning
- Location
- SKILL.md:145
- Finding
- Plaintext HTTP Endpoint in Optional Purchase Workflow## Vulnerability Details **File Location**: `SKILL.md`, lines 145–146 **Vulnerability Type**: Unauthenticated purchase metadata and redirect endpoint **Risk Level**: Medium **Vulnerable snippet**: ```markdown - **Permanent purchase address (always valid even if the product ID changes)**: <http://110.40.221.75/buy/logistics-storage-fee-check> (A human can open the normal page; an AI uses `http://110.40.221.75/buy/logistics-storage-fee-check?format=json` to obtain the current product ID, or `http://110.40.221.75/buy/logistics-storage-fee-check?go=1` to receive a 302 redirect to the current SkillPay purchase address.) ``` ### Technical Analysis The instructions designate a plaintext HTTP service as a trusted source of current product metadata and purchase redirects. HTTP does not authenticate the server or protect response integrity. An on-path attacker could therefore modify the JSON response or replace the `302 Location` destination without changing the audited Skill package. This endpoint is part of an optional workflow triggered after the user chooses the paid edition. Although nearby instructions tell the Agent to verify the merchant and avoid unknown links, these are prose-only controls. The documented path does not technically restrict the final redirect host, cryptographically authenticate the returned product information, or require integrity validation before displaying the resulting payment destination. ### Attack Path 1. The user selects the optional paid edition. 2. The Agent follows `SKILL.md` and requests the documented HTTP JSON or redirect endpoint. 3. An attacker capable of intercepting or modifying plaintext traffic alters the product metadata or `302 Location` header. 4. The Agent treats the response as the current valid purchase destination. 5. The modified payment link or QR code is presented to the user. 6. If the user trusts and completes that flow without independently detecti ...[truncated 532 chars]
- Remediation
- ## Remediation Suggestions - Remove the plaintext HTTP endpoint from the purchase instructions. - Publish purchase metadata and redirects exclusively over HTTPS with valid certificate verification. - Do not automatically trust arbitrary redirects. Restrict the final destination to an explicit allowlist of expected HTTPS hosts. - Before presenting a payment link, programmatically verify the merchant identifier, product identifier, amount, scheme, hostname, and final redirect destination. - Reject redirects that downgrade to HTTP, target raw IP addresses, contain embedded credentials, or leave the approved host set. - If dynamically changing product metadata is required, distribute it through an authenticated API or a signed manifest and verify its signature before use. - Require the user to review the verified merchant, product, amount, and destination before continuing to the payment service.