T09 · Insecure Skill Coding Practices
Warning
- Location
- client.ts:87
- Finding
- Unauthenticated Plaintext Transport for TTS Commands<![CDATA[ ## Vulnerability Details **File Location**: `client.ts:87-94`; related configuration examples in `SKILL.md:33, 53, 79` and validation in `config.ts:9-16` **Vulnerability Type**: Unauthenticated and unencrypted network communication **Risk Level**: Medium ### Vulnerable Code ```typescript response = await fetch(`${this.baseUrl}${path}`, { method, headers: { "Content-Type": "application/json" }, body: body === undefined ? undefined : JSON.stringify(body), signal: controller.signal }); ``` The documentation explicitly promotes a plaintext HTTP endpoint: ```json { "url": "http://192.168.1.60:5000", "defaultVoice": "zh-CN-XiaoxiaoNeural", "defaultVolume": 1.0, "timeout": 10000 } ``` ### Technical Analysis The HTTP client sends TTS text and control commands without authentication headers or a transport-level client identity. The documented configuration uses plaintext HTTP, meaning message contents and control requests are not protected for confidentiality or integrity while crossing the network. Although the service is intended for a local network, local networks should not be assumed trustworthy. A compromised wireless client, malicious LAN participant, or attacker controlling network infrastructure could observe or manipulate traffic. If the TTS server is reachable directly, the lack of application-layer authentication may also permit unauthenticated requests without intercepting an existing connection. The affected operations include: - `POST /play_tts`, containing arbitrary text, voice, and volume data - `POST /volume`, changing playback volume - `GET /status` - `GET /voices` No operating-system or OpenClaw privilege escalation is provided by this issue. The obtainable capability is limited to the network-accessible TTS service and the confidentiality and integrity of messages sent to it. ### Attack Path 1. A user configures the plugin with the documented `http://<windows-ip>:5000` endpoint. 2. The plugin sends a remind ...[truncated 1030 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Require HTTPS for non-loopback endpoints and reject plaintext HTTP by default. 2. Permit HTTP only through an explicit development or trusted-LAN override accompanied by a security warning. 3. Add application-layer authentication, such as a bearer token or request signing: ```typescript headers: { "Content-Type": "application/json", "Authorization": `Bearer ${config.apiToken}` } ``` 4. Prefer mutual TLS when the TTS server supports it, particularly on shared or enterprise networks. 5. Validate that the configured URL uses only the `https:` protocol, or narrowly allow `http:` for loopback/private-network use when explicitly requested. 6. Configure the TTS service firewall to accept connections only from the OpenClaw host. 7. Apply authentication and authorization checks on the server to all status, voice, playback, and volume endpoints. 8. Avoid logging TTS text or authentication credentials, because reminder content may contain private information. 9. Document the network trust assumptions and warn users not to expose the service directly to the Internet. ]]>