T09 · Insecure Skill Coding Practices
Error
- Location
- scripts/connect.sh:85
- Finding
- Sensitive Agent Configuration and Credentials May Be Transmitted over Insecure Transport## Vulnerability Details **File Location**: `scripts/connect.sh`, lines 85–110; URL acceptance at lines 329–336 **Vulnerability Type**: Sensitive data exposure through an unvalidated network destination and insecure transport **Risk Level**: High ### Vulnerable Code ```bash export_agent_files() { # $1 = kemia base URL, $2 = api key → writes agentId back to config.json local base="$1" key="$2" local files_json="[]" for md_file in SOUL.md IDENTITY.md USER.md MEMORY.md AGENTS.md TOOLS.md HEARTBEAT.md; do local filepath="${WORKSPACE}/${md_file}" if [ -f "${filepath}" ]; then local content content=$(jq -Rs '.' < "${filepath}") files_json=$(echo "${files_json}" | jq --arg fn "${md_file}" --argjson ct "${content}" '. + [{"filename": $fn, "content": $ct}]') echo " ✓ ${md_file}" fi done if [ "$(echo "${files_json}" | jq 'length')" = "0" ]; then echo " (no workspace .md files found — skipping export)" return 0 fi local payload payload=$(jq -n --arg name "${AGENT_NAME}" --argjson files "${files_json}" '{name: $name, files: $files}') local response response=$(curl -sf -X POST \ -H "Content-Type: application/json" \ -H "Authorization: Bearer ${key}" \ -d "${payload}" \ "${base}/api/v1/agents") || { ``` The destination is ultimately derived from an unrestricted command-line argument: ```bash if [ -z "${KEMIA_URL_ARG}" ]; then echo "Usage: /kemia connect <kemia-url>" echo "" echo "Example: /kemia connect https://kemia.byte5.ai" exit 1 fi start_new_enrollment "${KEMIA_URL_ARG%/}" ``` ### Technical Analysis The connection workflow accepts an arbitrary base URL without requiring HTTPS or restricting the destination to a trusted host. That URL is persisted and subsequently used for authenticated API requests. During enrollment, the script uploads the contents of up to seven workspace fi ...[truncated 1960 chars]
- Remediation
- ## Remediation Suggestions 1. Parse and validate the supplied URL before enrollment. 2. Require the `https` scheme for all non-loopback destinations. 3. If development support is necessary, allow plaintext HTTP only through an explicit opt-in flag and only for loopback addresses such as `127.0.0.1`, `::1`, or `localhost`. 4. Reject URLs containing embedded credentials, unexpected fragments, malformed ports, or unsupported schemes. 5. Before exporting files, display the canonical destination and exact list of files and obtain explicit user confirmation. 6. Make sensitive files such as `USER.md` and `MEMORY.md` opt-in rather than exporting them automatically. 7. Consider certificate pinning or a configurable trusted-host allowlist for managed deployments. 8. Use scoped, revocable API credentials with only the permissions required for the selected Agent.