T09 · Insecure Skill Coding Practices
- Location
content_stock.js:15- Finding
API Credential and Query Data Transmitted Over Plaintext HTTP
- Content
View full analysis
Vulnerability Details
File Location:
content_stock.js:15-25
Vulnerability Type: Plaintext transmission of sensitive information
Risk Level: HighVulnerable Code
javascript const url = "http://[IP_ADDRESS]/api/v1/alpha/content_stock"; const headers = { "Authorization": `Bearer ${EASYALPHA_API_KEY}`, "Content-Type": "application/json" }; const payload = { query: request.query, type: request.type || "deep" }; try { const response = await fetch(url, {The subsequent request configuration at lines 23-27 sends both the authorization header and serialized payload to this plaintext HTTP URL:
javascript const response = await fetch(url, { method: "POST", headers: headers, body: JSON.stringify(payload) });Technical Analysis
The skill sends
EASYALPHA_API_KEYas a Bearer credential in the HTTPAuthorizationheader. It also sends the user-provided stock-analysis query in the request body. Because the destination useshttp://rather thanhttps://, transport encryption and authenticated server identity are absent.Any party able to observe or manipulate traffic between the host and the API endpoint can read the credential and request content. Such a party can also alter requests or streamed responses without reliable detection. The placeholder-style IP address further provides no verifiable service identity in the reviewed implementation.
Attack Path
- A user configures a valid
EASYALPHA_API_KEYand invokesget_content_stock. - The skill creates a plaintext HTTP request containing
Authorization: Bearer <API_KEY>and the user-controlled analysis query. - An attacker with a network interception position, such as control of an untrusted access point, compromised router, proxy, or relevant network segment, captures or modifies the HTTP traffic.
- The attacker extracts the Bearer credential and submitted quer ...[truncated 1115 chars]
- A user configures a valid
- Remediation
View remediation
Remediation Suggestions
- Replace the plaintext endpoint with an
https://URL served under an explicitly trusted hostname. - Require normal TLS certificate and hostname validation. Do not disable certificate verification or accept arbitrary self-signed certificates in production.
- Reject any configured endpoint whose protocol is not HTTPS, preferably through strict URL validation and an allowlist of approved hosts.
- Avoid using a raw or placeholder IP address when a stable authenticated service hostname is available.
- Rotate any API key that may already have been transmitted through this implementation, because its confidentiality cannot be guaranteed.
- Restrict API keys to the minimum required operations, apply short expiration periods where possible, and enforce server-side rate limits and usage monitoring.
- Avoid logging authorization headers or full request payloads, and document clearly that user queries are transmitted to an external service.
- Consider response authentication or application-level integrity protections if the analysis output drives security-sensitive or automated financial actions.
- Replace the plaintext endpoint with an