T09 · Insecure Skill Coding Practices
- Location
SKILL.md:12- Finding
Authenticated Session Cookies May Be Transmitted to an Unspecified API over Plaintext or in GET Query Parameters
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md:12-13,SKILL.md:644-673,SKILL.md:810-842,SKILL.md:1374-1398,SKILL.md:1558-1591, andSKILL.md:1858-1883
Vulnerability Type: Insecure transport and handling of reusable session credentials
Risk Level: HighVulnerable Code Segments
The documented configuration permits a plaintext HTTP API destination:
json { "host": "http://xxx.com", "base_url": "http://xxx.com" }The Douyin collection endpoint requires a full web session cookie through a GET request:
text ### GET /api/douyin/web/fetch_user_collection_videos **Summary**: Get user collection video data ### Parameters: - cookie: User's web version of Douyin Cookie (This interface requires users to provide their own Cookie) - max_cursor: Maximum cursor - count: Maximum number cookie = "YOUR_COOKIE" max_cursor = 0 counts = 20The Douyin live-product endpoint similarly requires the user's cookie:
text ### GET /api/douyin/web/fetch_live_room_product_result **Summary**: Douyin live room product information ### Parameters: - cookie: User's web version of Douyin Cookie (This interface requires users to provide their own Cookie, if the acquisition fails, please manually pass the captcha code once) - room_id: Room room_id - author_id: Author id - limit: Number cookie = "YOUR_COOKIE" room_id = "7356742011975715619" author_id = "2207432981615527" limit = 20The generic cookie-update endpoint sends a replacement credential to the configured service:
text ### POST /api/hybrid/update_cookie **Summary**: Update Cookie ### Purpose: - Update Cookie for specified service ### Parameters: - service: Service name (e.g.: douyin_web) - cookie: New Cookie value ### Return: - Update result service = "douyin_web" cookie = "YOUR_NEW_COOKIE"The TikTok favorites endpoint also places a full account cookie in the param ...[truncated 4393 chars]
- Remediation
View remediation
Remediation Suggestions
-
Enforce encrypted transport
- Require
https://for every configured API endpoint. - Reject plaintext HTTP base URLs at configuration-validation time.
- Enable certificate verification and do not provide an option to bypass it.
- Consider certificate pinning when the API is controlled by the Skill publisher.
- Require
-
Do not transmit credentials in URLs
- Replace authenticated GET endpoints with POST requests.
- Carry credentials in a dedicated authorization header or an encrypted request body.
- Explicitly prohibit query-string, path, fragment, and referrer transmission of cookies.
- Configure responses and authenticated requests with appropriate no-store cache controls.
-
Apply credential minimization
- Identify and accept only the specific cookie fields required by each endpoint.
- Prefer official, narrowly scoped, short-lived authorization tokens where available.
- Perform authenticated extraction locally when possible so the session cookie never reaches a third-party service.
- Separate public-data endpoints from authenticated endpoints and require explicit user consent before the latter are invoked.
-
Protect credentials on the server
- Never log request headers or body fields containing credentials.
- Add application-level redaction for cookie names and values in errors, traces, metrics, and audit logs.
- Do not persist cookies by default.
- If retention is unavoidable, obtain explicit consent, encrypt credentials with a managed key, apply a short expiration, and tightly restrict decryption access.
- Ensure the cookie-update endpoint is strongly authenticated and authorized, or remove it if remote credential storage is unnecessary.
-
Clarify trust and lifecycle requirements
- Document the API operator, destination domains, credential use, retention period, subprocessors, and deletion behavior.
- Warn user ...[truncated 599 chars]
-