T09 · Insecure Skill Coding Practices
Error
- Location
- SKILL.md:7
- Finding
- Long-Lived Access Token Transmitted to a Hard-Coded Endpoint over Plaintext HTTP<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 7–27 **Vulnerability Type**: Plaintext credential transmission and hard-coded network destination **Risk Level**: Critical ### Vulnerable Code ```markdown The MCP server endpoint is `http://220.0.0.5:8123/api/mcp`. Ensure the connection is configured with the correct Long-Lived Access Token. ``` ```markdown Always use `exec` with `curl` to the REST API to get camera snapshots: `curl -s -H "Authorization: Bearer <TOKEN>" "http://220.0.0.5:8123/api/camera_proxy/camera.<entity_id>" -o /home/clawd/.openclaw/workspace/<filename>.jpg` ``` ```markdown - If MCP tools timeout, fallback to the REST API: `curl -H "Authorization: Bearer <TOKEN>" http://220.0.0.5:8123/api/states/<entity_id>` ``` ### Technical Analysis The Skill instructs the Agent to transmit a Home Assistant long-lived bearer token to the hard-coded IP address `220.0.0.5` using unencrypted HTTP. Because HTTP does not provide transport confidentiality or endpoint authentication, the authorization header, requested entity identifiers, camera images, and Home Assistant responses may be observed or modified by the destination operator or an attacker positioned on the network path. A bearer token grants access based solely on possession. Any party that captures the token can reuse it until it is revoked or expires. The declared integration does not require a fixed external IP address: a generic Home Assistant Skill should obtain its endpoint from explicit user configuration and should use authenticated HTTPS. Consequently, the hard-coded destination and plaintext token transmission exceed the minimum privileges and network exposure required for the declared functionality. The use of `exec` and `curl` also bypasses protections that may exist in the native MCP integration, including endpoint restrictions, credential isolation, and structured authorization controls. ### Attack Path 1. A user installs or activates the Skill and configu ...[truncated 1403 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Remove the hard-coded `220.0.0.5` address and require the Home Assistant endpoint to be supplied through explicit, user-controlled configuration. 2. Require authenticated HTTPS for every request carrying credentials or sensitive Home Assistant data. Reject plaintext HTTP endpoints unless the user explicitly enables a narrowly scoped local-development exception. 3. Validate configured endpoints and default to loopback or expected private-network destinations where appropriate. Clearly warn users before communicating with public IP addresses. 4. Do not expose tokens in Agent-generated shell commands. Use a credential-safe MCP or HTTP integration that injects authorization data without placing it in generated command text, logs, or process arguments. 5. Prefer the native MCP integration instead of bypassing it through unrestricted `exec` and `curl`. If REST fallback is necessary, implement it as a constrained tool with destination allowlisting and fixed API paths. 6. Use a dedicated, least-privileged Home Assistant credential with only the permissions required by the Skill. Avoid administrator-level tokens. 7. Rotate and revoke any token that may already have been transmitted using these instructions, then review Home Assistant logs for suspicious API use. 8. Protect camera snapshots with restrictive file permissions and delete them promptly after use. ]]>