T09 · Insecure Skill Coding Practices
- Location
SKILL.md:20- Finding
Credentials and Privileged Tokens May Be Transmitted over Plaintext HTTP
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 20–36
Vulnerability Type: Plaintext transmission of sensitive authentication data
Risk Level: MediumVulnerable Code
markdown ### Base URL The API base URL should be configured by the user. Default: `http://localhost:3552/api` ### Authentication Arcane supports two authentication methods: 1. **Bearer Token (JWT)**: Obtained via login endpoint 2. **API Key**: Long-lived authentication using `X-API-Key` header #### Getting a Bearer Token ```bash curl -X POST "$BASE_URL/auth/login" \ -H "Content-Type: application/json" \ -d '{ "username": "admin", "password": "your_password" }'text Related authenticated examples also use the HTTP default: ```python BASE_URL = "http://localhost:3552/api" TOKEN = "your-jwt-token" headers = { "Authorization": f"Bearer {TOKEN}", "Content-Type": "application/json" }bash BASE_URL="http://localhost:3552/api" TOKEN="your-jwt-token" curl -s -X "$method" "$BASE_URL/$endpoint" \ -H "Authorization: Bearer $TOKEN"Technical Analysis
The Skill instructs users to submit account passwords and reusable bearer tokens to a configurable API base URL while setting the default scheme to unencrypted HTTP. Loopback HTTP reduces exposure when Arcane and the client are strictly confined to the same trusted host, but the examples neither enforce loopback-only use nor reject remote HTTP destinations.
If
BASE_URLis changed to a remote HTTP endpoint, authentication data can traverse the network without transport encryption. An attacker with a suitable network position could observe or modify the request. An attacker who can influence API configuration could also direct authentication requests to an attacker-controlled endpoint. The later recommendation to use HTTPS in production does not technically enforce secure transport in the executable examples.The network communication itself is necessary for the declared Arcane-ma ...[truncated 1817 chars]
- Remediation
View remediation
Remediation Suggestions
- Require HTTPS for every non-loopback API endpoint and fail closed when a remote URL uses HTTP.
- Explicitly restrict plaintext HTTP to
localhost,127.0.0.1, or another carefully validated local transport if compatibility requires it. - Validate the URL scheme and destination before attaching a password, bearer token, refresh token, or API key.
- Disable redirects for authentication requests, or verify that every redirect remains on the expected HTTPS origin before forwarding credentials.
- Keep TLS certificate verification enabled and document the secure installation of private certificate authorities where applicable.
- Replace production-oriented examples with an HTTPS base URL and clearly label loopback HTTP as a local-development exception.
- Read secrets from protected environment variables or an operating-system secret store rather than embedding them in scripts.
- Avoid password-bearing command-line examples where credentials may leak through shell history, logs, or copied command output. Prefer interactive input or a protected configuration source.
- Use short-lived, least-privileged tokens and narrowly scoped API keys. Rotate them regularly and revoke them immediately after suspected disclosure.
- Require explicit user confirmation before destructive actions such as deletion, pruning, account changes, or container command execution.