T09 · Insecure Skill Coding Practices
Error
- Location
- src/config.js:15
- Finding
- Bearer Credentials and Sensitive Collection URLs Transmitted over Plaintext HTTP## Vulnerability Details **File Location**: `src/config.js:15`, with credential transmission at `src/client.js:55-64` and `cli.js:294-295` **Vulnerability Type**: Cleartext transmission of sensitive information **Risk Level**: High ### Technical Analysis The Skill uses a plaintext HTTP endpoint as its default service URL: ```js const DEFAULT_BASE_URL = 'http://st.aidata366.com'; ``` The general API client constructs requests from this URL and adds the saved bearer token to authenticated requests: ```js res = await fetch(this.baseUrl + '/api/v1' + apiPath, { method, headers: { ...(body ? { 'Content-Type': 'application/json' } : {}), ...(this.token ? { Authorization: `Bearer ${this.token}` } : {}), ...headers, }, body: body ? JSON.stringify(body) : undefined, signal: ctrl.signal, }); ``` The CSV download path likewise sends the bearer token directly to the configured endpoint: ```js const res = await fetch(`${cfg.baseUrl}/api/v1/platform/exports/${encodeURIComponent(info.export_id)}/file`, { headers: { Authorization: `Bearer ${cfg.token}` } }); ``` Consequently, authenticated commands executed with the default configuration transmit bearer credentials without transport encryption. Task submissions also include user-supplied Xiaohongshu URLs containing `xsec_token` values in plaintext request bodies. Registration and login-session operations use the same default service origin. Users can override `base-url` with an HTTPS URL, but this does not protect the documented and coded default path. There is no scheme enforcement that prevents authenticated operations over HTTP. ### Attack Path 1. A user registers, logs in, or runs an authenticated command while retaining the default base URL. 2. The CLI connects to `http://st.aidata366.com` without TLS. 3. For authenticated operations, the CLI sends `Authorization: Bearer <token>` over the plaintext connection. Submissio ...[truncated 1110 chars]
- Remediation
- ## Remediation Suggestions 1. Replace the default endpoint with an HTTPS URL using a valid, trusted certificate. 2. Reject `http://` base URLs for login, registration, authenticated API requests, submissions containing `xsec_token`, and export downloads. 3. Validate the effective URL after applying command-line, environment, and configuration overrides; do not rely only on the default value. 4. If plaintext HTTP is needed for local development, permit it only for loopback addresses through an explicit development-only option, and never send production credentials through that mode. 5. Remove or tightly restrict the process-wide `NODE_TLS_REJECT_UNAUTHORIZED=0` behavior. Prefer a narrowly scoped custom CA configuration for private deployments. 6. Invalidate existing bearer tokens if they may have been used through the plaintext default endpoint, and issue replacement credentials after HTTPS enforcement is deployed. 7. Add automated tests confirming that credential-bearing requests fail before transmission when the effective service URL is not securely authenticated.