T09 · Insecure Skill Coding Practices
Error
- Location
scripts/generate.py:12- Finding
Authentication Key and Customer Data Transmitted over Plaintext HTTP
- Content
View full analysis
Vulnerability Details
File Location:
scripts/generate.py:12-24, 84-96
Vulnerability Type: Plaintext transmission of credentials and potentially sensitive customer data
Risk Level: HighEvidence
python API_BASE = os.environ.get("TELE_SCRIPT_API_URL", "http://47.109.39.255:8765/api/v4") USER_KEY = os.environ.get("TELE_SCRIPT_USER_KEY", "") def api_call(endpoint, data=None, method="POST"): url = f"{API_BASE.rstrip('/')}/{endpoint}" h = {"Content-Type": "application/json"} if USER_KEY: h["X-User-Key"] = USER_KEY try: if method == "GET": resp = requests.get(url, headers=h, params=data or {}, timeout=30) else: resp = requests.post(url, headers=h, json=data or {}, timeout=60)python def cmd_generate(args): if not USER_KEY: print("❌ Please set the TELE_SCRIPT_USER_KEY environment variable first", file=sys.stderr) print(" Registration command: script register --username YOUR_NAME", file=sys.stderr) sys.exit(1) print(f"🚀 Generating telemarketing script...", file=sys.stderr) data = {} data['product_name'] = args.product if args.product_type: data['product_type'] = args.product_type if args.target: data['target_customer'] = args.target if args.pain: data['customer_pain_point'] = args.pain if args.tone: data['tone'] = args.tone if args.length: data['script_length'] = args.length result = api_call("tele-script", data)Technical Analysis
The default API endpoint uses unencrypted HTTP and is addressed through a bare IP address. The script places
TELE_SCRIPT_USER_KEYin theX-User-Keyrequest header and submits product names, target-customer descriptions, customer pain points, and other generation parameters in the request body.HTTP does not provide transport confidentiality, server authentication, or message integrity. An att ...[truncated 1589 chars]
- Remediation
View remediation
Remediation Suggestions
- Replace the default endpoint with an HTTPS URL on a clearly identified service domain.
- Enforce HTTPS in code and reject
http://endpoints, including user-supplied overrides, unless an explicit development-only mode is enabled. - Use normal certificate and hostname validation; do not disable TLS verification.
- Clearly disclose the service operator, destination, transmitted fields, retention policy, and intended processing before collecting data.
- Minimize submitted information and avoid transmitting personally identifiable or confidential customer data unless necessary and authorized.
- Use revocable, narrowly scoped, short-lived credentials where the backend supports them.
- Add server-side rate limiting, key rotation, and usage monitoring to reduce damage from stolen keys.
- Treat all remote responses as untrusted and validate their structure before displaying or processing them.