T09 · Insecure Skill Coding Practices
Warning
- Location
- SKILL.md:130
- Finding
- Plaintext HTTP endpoint controls payment routing## Vulnerability Details **File Location**: `SKILL.md`, lines 130–131 **Vulnerability Type**: Unauthenticated payment metadata and redirect retrieval **Risk Level**: Medium **Vulnerable snippet**: ```markdown - **Permanent purchase address (remains valid even if the product ID changes)**: <http://110.40.221.75/buy/restaurant-food-cost-check> (Humans open the regular page; AI uses `http://110.40.221.75/buy/restaurant-food-cost-check?format=json` to obtain the current product ID, while `http://110.40.221.75/buy/restaurant-food-cost-check?go=1` returns a 302 redirect to the current SkillPay purchase address.) ``` ### Technical Analysis The skill instructs an agent to retrieve dynamic product information or a payment redirect over unencrypted, unauthenticated HTTP. The endpoint is explicitly part of the optional paid-edition workflow and is described as the source for the current product ID and purchase destination. HTTP provides neither transport confidentiality nor server authentication. An on-path attacker—such as a hostile network gateway, compromised router, or malicious Wi-Fi operator—can modify the JSON response or replace the `302` redirect target. The resulting attacker-selected value then crosses from untrusted network traffic into a payment and installation workflow presented as a stable, trusted purchase route. The surrounding instructions tell the agent to verify the merchant ID, product ID, order, and amount and not to pay on the user's behalf. Those precautions reduce exploitation likelihood but do not authenticate this HTTP endpoint or guarantee that the destination displayed to the user is genuine. ### Attack Path 1. The user selects the optional paid edition. 2. Following `SKILL.md`, the agent requests the `?format=json` or `?go=1` URL over HTTP. 3. An on-path attacker intercepts the plaintext request. 4. The attacker alters the product metadata or substitutes the redirect destination. ...[truncated 845 chars]
- Remediation
- ## Remediation Suggestions 1. Remove all plaintext HTTP purchase and redirect endpoints. 2. Serve the purchase page, metadata API, and redirect endpoint exclusively over HTTPS with valid certificate verification. 3. Prefer a fixed, allowlisted HTTPS destination under the expected payment platform domain instead of an IP-address-based intermediary. 4. If product metadata must remain dynamic, digitally sign it and verify the signature before using the merchant ID, product ID, amount, or destination. 5. Before presenting a payment link, require exact validation of the HTTPS scheme, destination hostname, merchant ID, product ID, order details, and amount. 6. Reject cross-origin redirects and any redirect that downgrades to HTTP or points outside an explicit destination allowlist. 7. Preserve the existing requirement that payment must be confirmed by the user and must never be completed automatically by the agent.