T09 · Insecure Skill Coding Practices
- Location
SKILL.md:55- Finding
Plaintext Transmission of Signed Download Tokens and Private Ride Data
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 55–65
Vulnerability Type: Sensitive data and bearer-like token transmission over plaintext HTTP
Risk Level: HighVulnerable Code Snippet
text http://fits.rfsvr.net/MAGENE_C416_2026-03-19-09-34-33_1078400_1773886046761.fit?e=1773892823&token=xxxbash # Create the destination directory mkdir -p /home/ckboss/Downloads/onelap-rides-YYYYMMDD # Download one file curl -s -o "2026-03-19_09-34.fit" "http://fits.rfsvr.net/xxx.fit?token=xxx"The same insecure HTTP URL pattern is repeated in the page-data example at line 108.
Technical Analysis
The documented workflow retrieves personal FIT activity records from an unencrypted
http://endpoint. The URL contains an expiration value and atokenquery parameter that functions like a temporary bearer credential: possession of a valid URL may be sufficient to retrieve the corresponding ride file.Because HTTP provides neither transport confidentiality nor server authenticity, an attacker with a suitable network position could observe the complete request URL, capture its token, modify the server response, or redirect the request. The recommended
curlinvocation also suppresses output with-sand does not enable failure reporting, constrain redirect protocols, validate the expected content type, or verify that the resulting file is a valid FIT record. Consequently, an HTTP error page or attacker-controlled response may be saved under a trusted.fitfilename without detection.Attack Path
- A user invokes the Skill while authenticated to Onelap.
- The Skill extracts a time-limited FIT URL containing a download token.
- The documented command submits that URL over plaintext HTTP.
- An attacker monitoring or controlling a network segment observes the URL and token.
- Before expiration, the attacker reuses the captured URL to retrieve the private ride record.
- Alternatively, an active attacker intercepts the HTT ...[truncated 933 chars]
- Remediation
View remediation
Remediation Suggestions
- Require an official HTTPS endpoint for every download and reject all non-HTTPS FIT URLs before invoking
curl. - Use hardened download options, for example:
bash curl \ --fail \ --show-error \ --location \ --proto '=https' \ --proto-redir '=https' \ --output "2026-03-19_09-34.fit" \ "$FIT_URL"- Validate that
$FIT_URLhas the expected HTTPS scheme and an allowlisted hostname before use. - Do not print, persist, or include signed URLs in logs, reports, shell history, or examples containing real tokens.
- Download to a newly created, access-restricted temporary file and move it to the final location only after successful validation.
- Verify the HTTP status, expected content type, reasonable file size, and FIT file signature before treating the response as a valid activity record.
- Use restrictive permissions for downloaded personal records, such as a user-only directory and
umask 077. - If the service supports it, use short-lived, narrowly scoped tokens and invalidate them after successful retrieval.
- Avoid silent failure handling. Ensure that authentication failures, redirects to unexpected hosts, and invalid responses stop the workflow rather than producing misleading
.fitfiles.
- Require an official HTTPS endpoint for every download and reject all non-HTTPS FIT URLs before invoking