T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:21- Finding
Bearer Token Can Be Transmitted Over an Unencrypted or Untrusted Connection
- Content
View full analysis
curl -s -X POST "$MEALIE_URL/api/recipes" \ -H "Authorization: Bearer $MEALIE_TOKEN" \ -H "Content-Type: application/json" \ --data @${1} ;; get-recipe) # Usage: mealie.sh get-recipe curl -s "$MEALIE_URL/api/recipes/${1}" \ -H "Authorization: Bearer $MEALIE_TOKEN" | jq '.' ;; create-plan) # Usage: mealie.sh create-plan curl -s -X POST "$MEALIE_URL/api/mealplan" \ -H "Authorization: Bearer $MEALIE_TOKEN" \ -H "Content-Type: application/json" \ --data @${1} ;; get-shopping) # Usage: mealie.sh get-shopping curl -s "$MEALIE_URL/api/mealplan/${1}/shopping-list" \ -H "Authorization: Bearer $MEALIE_TOKEN" | jq '.' ;; *) echo "Unknown command: $cmd" >&2 exit 1 ;; esac ``` ### Technical Analysis The documented helper sends `MEALIE_TOKEN` in an HTTP `Authorization` header to the host specified by the externally controlled `MEALIE_URL` environment variable. Sending a bearer token to the configured Mealie API is necessary for the declared functionality. However, the implementation does not validate the URL scheme, hostname, or presence of embedded credentials before transmitting the token. Although the documented example uses HTTPS, the helper accepts an `http://` URL. In that configuration, the bearer token and API data travel without transport encryption and can be intercepted by systems with visibility into the network path. An incorrectly configured or attacker-influenced UR ...[truncated 1783 chars]- Remediation
View remediation
&2 exit 1 ;; esac ``` 2. Parse and validate the destination hostname. Where practical, compare it against an explicitly configured allowlist or require user confirmation before sending credentials to a new host. 3. Reject malformed URLs, embedded user information, fragments, and unexpected query components. Normalize trailing slashes before appending API paths. 4. Preserve TLS certificate verification. Do not add `curl --insecure` or otherwise disable certificate checks. 5. Use safer error handling so failed requests are visible: ```bash curl --fail --show-error --silent ... ``` 6. Use a narrowly scoped Mealie API token where the server supports restricted permissions. Rotate the token immediately if it may have been exposed. 7. Add the claimed `scripts/mealie.sh` file to the package so its actual implementation can be reviewed and tested, or revise `SKILL.md` to make clear that the code is only an example. 8. Document that credentials must never be sent to plaintext HTTP endpoints, including internal network addresses, unless equivalent authenticated encryption is provided by a separately verified transport layer. ]]>