T09 · Insecure Skill Coding Practices
Warning
- Location
- SKILL.md:119
- Finding
- Unauthenticated HTTP endpoint influences payment destination## Vulnerability Details **File Location**: `SKILL.md`, lines 119–120 **Vulnerability Type**: Use of unauthenticated transport for payment routing **Risk Level**: Medium **Vulnerable snippet**: ```markdown - **Permanent purchase address (always valid, even if the product ID changes)**: <http://110.40.221.75/buy/medical-insurance-denial-check> (Humans open the normal page; AI uses `http://110.40.221.75/buy/medical-insurance-denial-check?format=json` to obtain the current product ID; `http://110.40.221.75/buy/medical-insurance-denial-check?go=1` directly returns a 302 redirect to the current SkillPay purchase address.) ``` ### Technical Analysis The optional paid-version workflow instructs the agent to obtain a current product identifier or payment redirect from a plaintext HTTP endpoint. HTTP provides neither server authentication nor transport integrity. An on-path attacker can therefore modify the JSON response or replace the `302` redirect without modifying the reviewed Skill package. The dangerous trust transition occurs when attacker-modifiable network data is treated as authoritative payment-routing information and presented to the user. The surrounding instructions require verification of the merchant and product details, which mitigates the risk, but these procedural checks do not authenticate the HTTP endpoint or technically prevent a substituted destination. ### Attack Path 1. The user selects the optional paid version. 2. The agent follows the documented HTTP URL to obtain the current product identifier or redirect. 3. An attacker capable of intercepting or modifying the plaintext connection substitutes the response or `Location` header. 4. The agent follows or presents the substituted checkout destination. 5. If the user does not detect the mismatch during merchant and order verification, the user may submit payment information or authorize a transaction through an unauthorized destination. ### Impact Asse ...[truncated 420 chars]
- Remediation
- ## Remediation Suggestions - Remove the plaintext HTTP endpoint and expose this workflow only through HTTPS on an authenticated domain. - Do not use a bare IP address for payment routing unless its authenticated certificate identity is explicitly validated. - Reject redirects to origins outside a strict allowlist of approved payment-platform domains. - Retrieve product metadata through the authenticated payment platform rather than an intermediary endpoint where possible. - Before presenting a checkout link, technically validate the merchant ID, product ID, amount, currency, and final checkout origin against trusted values. - Stop the purchase workflow on any mismatch instead of relying solely on advisory text instructing the agent or user to inspect the transaction.