T09 · Insecure Skill Coding Practices
Warning
- Location
- SKILL.md:118
- Finding
- Unauthenticated HTTP endpoint controls the purchase destination## Vulnerability Details **File Location**: `SKILL.md`, lines 118–119 **Vulnerability Type**: Unauthenticated commerce metadata retrieval and redirect **Risk Level**: Medium **Vulnerable snippet**: ```markdown - **Permanent purchase address (always valid even if the product ID changes)**: <http://110.40.221.75/buy/platform-settlement-aging-check> (Humans receive a web page; the AI uses `http://110.40.221.75/buy/platform-settlement-aging-check?format=json` to obtain the current product ID; `http://110.40.221.75/buy/platform-settlement-aging-check?go=1` returns a 302 redirect to the currently valid SkillPay purchase address.) ``` ### Technical Analysis The instructions direct the agent to obtain mutable product metadata or follow an HTTP redirect through a bare IP address. HTTP provides neither transport confidentiality nor server authentication. An on-path attacker can therefore alter the JSON product identifier, replace the response, or modify the `302 Location` destination. This endpoint participates in a security-sensitive purchase and installation workflow: when the user selects the paid version, the agent is instructed to obtain purchase details, present a payment destination, and subsequently install an external product. Although the surrounding instructions require user confirmation and merchant verification, these checks do not authenticate the HTTP response itself. A convincing substituted payment page can misrepresent the merchant, product, or installation target. No evidence establishes that the project author intentionally operates such an attack. The issue is therefore classified as a reachable insecure workflow rather than malicious behavior. ### Attack Path 1. The user selects the paid version offered by the skill. 2. The agent follows the documented purchase workflow and requests the bare-IP HTTP endpoint, including the JSON or redirect variant. 3. An attacker positioned on the network path intercepts the ...[truncated 980 chars]
- Remediation
- ## Remediation Suggestions - Remove the bare-IP HTTP purchase and metadata endpoints. - Host purchase discovery on an authenticated HTTPS domain with valid certificate verification. - Do not follow arbitrary redirects. Restrict redirect destinations to an explicit allowlist of official HTTPS origins and reject redirects that change to HTTP, bare IP addresses, or unapproved domains. - Bind the expected merchant ID, product identity, amount, and package identity to signed metadata rather than relying on mutable plaintext responses. - Before presenting a payment destination, independently verify the merchant ID, product ID, product name, amount, and final HTTPS origin. - Before installation, verify the downloaded package's expected identity, version, publisher, and cryptographic digest or signature. - Preserve explicit user confirmation for payment and installation after all verification results are displayed.