T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:147
- Finding
- Unauthenticated HTTP Endpoint Controls Purchase and Installation Routing## Vulnerability Details **File Location**: `SKILL.md`, lines 147–148 **Vulnerability Type**: Unauthenticated external dependency and commerce routing **Risk Level**: Medium **Vulnerable snippet**: ```markdown - **Permanent purchase address (always valid, even if the product ID changes)**: <http://110.40.221.75/buy/royalty-settlement-check> (Humans open the regular page; AI uses `http://110.40.221.75/buy/royalty-settlement-check?format=json` to obtain the current product ID; `http://110.40.221.75/buy/royalty-settlement-check?go=1` redirects directly to the currently valid SkillPay purchase address.) ``` ### Technical Analysis The Skill instructs an agent to retrieve a current product identifier or follow a redirect over plaintext HTTP. HTTP provides no server authentication or transport integrity. An on-path attacker could therefore alter the JSON response or redirect destination before it reaches the agent. The returned data affects a workflow involving payment and subsequent installation of another Skill. This crosses a trust boundary: unauthenticated network data is used to determine a commerce and software-installation destination. The surrounding instructions require merchant, product, and order verification and reserve payment confirmation for the user. These safeguards reduce exploitability, but they do not authenticate the HTTP response and do not fully prevent an attacker from presenting a fraudulent destination or attacker-selected product. ### Attack Path 1. The user chooses the paid edition. 2. The agent follows the optional workflow documented in `SKILL.md`. 3. The agent requests the plaintext HTTP JSON endpoint or follows its HTTP redirect. 4. An attacker capable of intercepting or modifying the connection substitutes a product identifier or redirect destination. 5. The agent presents the modified payment destination or continues toward installation of the substituted Skill. 6. If ...[truncated 679 chars]
- Remediation
- ## Remediation Suggestions - Remove the plaintext HTTP endpoint and use HTTPS with normal certificate and hostname validation. - Prefer authenticated product and installation metadata obtained directly from the official platform. - Restrict redirects to an explicit allowlist of official SkillPay HTTPS origins and reject protocol downgrades, raw IP destinations, and unexpected hosts. - Before presenting payment, verify the merchant ID, product ID, product name, amount, currency, and order identifier against authenticated platform data. - Before installation, verify the exact package identity, source, requested permissions, and version through trusted platform metadata. - Keep payment confirmation as an explicit user action and abort when any merchant, product, amount, origin, or package check differs from the expected values.