T09 · Insecure Skill Coding Practices
- Location
src/config.js:17- Finding
Bearer Token Transmitted Over Plaintext HTTP by Default
- Content
View full analysis
Vulnerability Details
File Location:
src/config.js:17-20,src/client.js:52-72
Vulnerability Type: Plaintext transmission of authentication credentials
Risk Level: HighTechnical Analysis
The Skill uses a plaintext HTTP endpoint as its default service URL:
js // Security note: the service certificate is not ready, so HTTP remains the default. // The original source comments explicitly acknowledge this transport risk. const DEFAULT_BASE_URL = 'http://st.aidata366.com';Authenticated API requests attach the account bearer token to requests made against that URL:
js async request(method, apiPath, opts = {}) { const { body, headers = {}, timeoutMs = REQUEST_TIMEOUT_MS } = opts; // Plaintext HTTP with a token only emits a warning; it does not stop the request. if (!_httpWarned && this.token && this.baseUrl.startsWith('http://')) { _httpWarned = true; process.stderr.write('[warn] 当前服务地址为明文 http，token 会明文传输，建议确认网络安全或切换 https\n'); } const ctrl = new AbortController(); const timer = setTimeout(() => ctrl.abort(), timeoutMs); let res; let payload = null; try { res = await fetch(this.baseUrl + '/api/v1' + apiPath, { method, headers: { ...(body ? { 'Content-Type': 'application/json' } : {}), ...(this.token ? { Authorization: `Bearer ${this.token}` } : {}), ...headers, }, body: body ? JSON.stringify(body) : undefined, signal: ctrl.signal, });The warning does not provide a technical security boundary. Authenticated operations such as
quota,collect,query,export, andlogouttherefore transmit the bearer credential and associated API traffic without transport encryption under the default configuration.This crosses the trust boundary between the local machine and the remote service over the intervening network. The behavior is disclosed in `SKILL. ...[truncated 1392 chars]
- Remediation
View remediation
Remediation Suggestions
- Change the default service endpoint to HTTPS with a certificate that passes normal hostname and chain validation.
- Reject authenticated requests to non-HTTPS endpoints rather than merely emitting a warning.
- If plaintext transport is required for local development, restrict it to loopback addresses and require an explicit development-only override.
- Do not recommend disabling TLS certificate verification as a production workaround. Provision and renew a valid server certificate instead.
- Consider revoking or rotating tokens previously used over plaintext transport.
- Add a regression test verifying that requests containing an authorization token fail before network transmission when the destination uses HTTP.