T09 · Insecure Skill Coding Practices
- Location
claw-openwebui.sh:5- Finding
Bearer tokens and sensitive user content may be transmitted over plaintext HTTP
- Content
View full analysis
Vulnerability Details
File Location:
claw-openwebui.sh:5,claw-openwebui.sh:139-142,claw-openwebui.sh:189-192,scripts/upload.py:44-53,scripts/chat.py:42-48,scripts/search.py:48-54,scripts/list_files.py:33-38,SKILL.md:44-45,README.md:42-43
Vulnerability Type: Plaintext transmission of credentials and sensitive content
Risk Level: HighVulnerable Code
claw-openwebui.sh:5assigns a plaintext HTTP endpoint, including a hard-coded LAN host, when the URL environment variable is absent:bash WEBUI_URL="${OPENWEBUI_URL:-http://192.168.0.176:3000}"claw-openwebui.sh:139-142sends the API bearer token and the complete selected file to that endpoint:bash local upload_response=$(curl -s -X POST "$WEBUI_URL/api/v1/files/" \ -H "Authorization: Bearer $API_KEY" \ -H "Accept: application/json" \ -F "file=@$file_path")claw-openwebui.sh:189-192performs the same sensitive transmission in the standalone upload operation:bash local response=$(curl -s -X POST "$WEBUI_URL/api/v1/files/" \ -H "Authorization: Bearer $API_KEY" \ -H "Accept: application/json" \ -F "file=@$file_path")scripts/upload.py:44-53trusts the user-controlled URL without requiring HTTPS and transmits both the token and file:python with open(file_path, 'rb') as f: files = { 'file': (file_name, f) } response = requests.post( f"{config['url']}/api/v1/files/upload", headers=headers, files=files, timeout=60 )Similar URL construction and authenticated requests are used for chat messages, RAG search queries, and file listings:
python response = requests.post( f"{config['url']}/api/v1/chat/completions", headers=headers, json=payload, timeout=60 )python response = requests.post( f"{config['url']}/api/v1/rag", headers=h ...[truncated 3468 chars]- Remediation
View remediation
Remediation Suggestions
-
Require HTTPS by default. Parse
OPENWEBUI_URLand reject any scheme other thanhttps://before attaching credentials or transmitting content.python from urllib.parse import urlparse parsed = urlparse(url) if parsed.scheme != "https": raise ValueError("OPENWEBUI_URL must use HTTPS") -
Fail closed when configuration is absent. Remove the hard-coded LAN fallback from
claw-openwebui.sh:bash WEBUI_URL="${OPENWEBUI_URL:-}" if [ -z "$WEBUI_URL" ]; then echo "Error: OPENWEBUI_URL must be set" >&2 exit 1 fi -
Permit plaintext only through an explicit development override. If localhost HTTP support is operationally necessary, require a clearly named option such as
OPENWEBUI_ALLOW_INSECURE_HTTP=true, restrict it to loopback destinations, and display a prominent warning. Do not permit insecure remote or LAN destinations by default. -
Preserve certificate verification. Continue using the default TLS verification behavior in
requests. Do not introduceverify=Falseor curl's--insecure. Document how administrators should deploy a trusted certificate or configure an appropriate private certificate authority. -
Validate the destination before opening files. Perform scheme and host validation before reading an upload path so sensitive local content is never opened for an invalid or disallowed destination.
-
Correct the documentation. Replace all recommended
http://examples withhttps://examples. If loopback-only development examples remain, clearly state that they must not be used across a network. -
Reduce token exposure and scope. Use a dedicated, minimally privileged Open WebUI token for this Skill, rotate it regularly, and revoke it immediately after suspected interception.
-
Add explicit upload confirmation. Before transmitting a file, display the normalized destination ho ...[truncated 139 chars]
-