T09 · Insecure Skill Coding Practices
Warning
- Location
- SKILL.md:21
- Finding
- Bearer Token Can Be Transmitted Over an Unencrypted or Untrusted Connection<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 21–52 **Vulnerability Type**: Missing transport and destination validation for sensitive credentials **Risk Level**: Medium ### Vulnerable Code ```bash #!/usr/bin/env bash # mealie.sh – simple wrapper for Mealie REST API # Requires MEALIE_URL and MEALIE_TOKEN env vars set -euo pipefail cmd=$1; shift case "$cmd" in add-recipe) # Usage: mealie.sh add-recipe <path‑to‑json> curl -s -X POST "$MEALIE_URL/api/recipes" \ -H "Authorization: Bearer $MEALIE_TOKEN" \ -H "Content-Type: application/json" \ --data @${1} ;; get-recipe) # Usage: mealie.sh get-recipe <recipe‑id> curl -s "$MEALIE_URL/api/recipes/${1}" \ -H "Authorization: Bearer $MEALIE_TOKEN" | jq '.' ;; create-plan) # Usage: mealie.sh create-plan <json‑payload> curl -s -X POST "$MEALIE_URL/api/mealplan" \ -H "Authorization: Bearer $MEALIE_TOKEN" \ -H "Content-Type: application/json" \ --data @${1} ;; get-shopping) # Usage: mealie.sh get-shopping <plan‑id> curl -s "$MEALIE_URL/api/mealplan/${1}/shopping-list" \ -H "Authorization: Bearer $MEALIE_TOKEN" | jq '.' ;; *) echo "Unknown command: $cmd" >&2 exit 1 ;; esac ``` ### Technical Analysis The documented helper sends `MEALIE_TOKEN` in an HTTP `Authorization` header to the host specified by the externally controlled `MEALIE_URL` environment variable. Sending a bearer token to the configured Mealie API is necessary for the declared functionality. However, the implementation does not validate the URL scheme, hostname, or presence of embedded credentials before transmitting the token. Although the documented example uses HTTPS, the helper accepts an `http://` URL. In that configuration, the bearer token and API data travel without transport encryption and can be intercepted by systems with visibility into the network path. An incorrectly configured or attacker-influenced UR ...[truncated 1783 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Validate `MEALIE_URL` before issuing any authenticated request and reject all schemes other than HTTPS: ```bash case "${MEALIE_URL:-}" in https://*) ;; *) echo "MEALIE_URL must use HTTPS" >&2 exit 1 ;; esac ``` 2. Parse and validate the destination hostname. Where practical, compare it against an explicitly configured allowlist or require user confirmation before sending credentials to a new host. 3. Reject malformed URLs, embedded user information, fragments, and unexpected query components. Normalize trailing slashes before appending API paths. 4. Preserve TLS certificate verification. Do not add `curl --insecure` or otherwise disable certificate checks. 5. Use safer error handling so failed requests are visible: ```bash curl --fail --show-error --silent ... ``` 6. Use a narrowly scoped Mealie API token where the server supports restricted permissions. Rotate the token immediately if it may have been exposed. 7. Add the claimed `scripts/mealie.sh` file to the package so its actual implementation can be reviewed and tested, or revise `SKILL.md` to make clear that the code is only an example. 8. Document that credentials must never be sent to plaintext HTTP endpoints, including internal network addresses, unless equivalent authenticated encryption is provided by a separately verified transport layer. ]]>