T09 · Insecure Skill Coding Practices
- Location
scripts/synthesize_qa.py:109- Finding
Cleartext Transmission of Corpus Data and API Credentials
- Content
View full analysis
Vulnerability Details
File Location:
scripts/synthesize_qa.py, lines 109-136
Vulnerability Type: Sensitive data and bearer credentials transmitted over an unrestricted HTTP endpoint
Risk Level: Mediumpython def complete(self, model: str, system: str, user: str) -> str: if self._base.endswith("/chat/completions"): url = self._base elif self._base.endswith("/v1"): url = f"{self._base}/chat/completions" else: url = f"{self._base}/v1/chat/completions" body: dict[str, Any] = { "model": model, "messages": [ {"role": "system", "content": system}, {"role": "user", "content": user}, ], "max_tokens": int(self._cfg.max_tokens), "temperature": float(self._cfg.temperature), } data = json.dumps(body).encode("utf-8") headers = {"Content-Type": "application/json"} if self._cfg.api_key: headers["Authorization"] = f"Bearer {self._cfg.api_key}" req = urllib.request.Request(url, data=data, headers=headers, method="POST") try: with urllib.request.urlopen(req, timeout=self._cfg.timeout_sec) as resp: payload = json.loads(resp.read().decode("utf-8"))Technical Analysis
The configurable
OPENAI_BASE_URLis used without validating its URL scheme. Consequently, the client acceptshttp://endpoints as well as HTTPS endpoints. The project documentation explicitly presents an HTTP endpoint as a configuration example.In API mode, each request body contains CSV-derived corpus chunks in
messages[].content. Answer-generation requests also contain generated questions. WhenOPENAI_API_KEYis configured, the same request carries the credential in a bearerAuthorizationheader.Over plain HTTP, neither the request body nor its headers receive transport confidentiality or integrity protection. A network-positioned attacker can therefore ob ...[truncated 1651 chars]
- Remediation
View remediation
Remediation Suggestions
- Require
https://for all non-local API endpoints and reject cleartext URLs before constructing a request. - If HTTP is needed for isolated development environments, require an explicit option such as
--allow-insecure-http; do not enable it through the endpoint value alone. - Restrict any HTTP exception to loopback or explicitly approved private endpoints and emit a prominent warning that request content is unencrypted.
- Never attach an
Authorizationheader to an HTTP request. Fail closed if a credential is configured with an insecure endpoint. - Update
SKILL.mdto use an HTTPS endpoint and clearly disclose that API mode sends source corpus text to the configured service. - Consider endpoint allowlisting, certificate validation guidance for internal gateways, and preflight confirmation that displays the destination host before processing corpus data.
- Minimize transmitted data where feasible by redacting secrets or personally identifiable information before synthesis and by limiting chunk content to what the generation task requires.
- Require