other
Warning
- Location
- SKILL.md:39
- Finding
- Remote API Is Mischaracterized as Local and Receives an Authentication Token<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 39–51 and line 112 **Vulnerability Type**: Undisclosed External API Interaction **Risk Level**: Medium ### Vulnerable Code Snippet ```http GET https://tczlld.com/trade/api/stocks/{code} Authorization: Bearer <STOCK_API_TOKEN> ``` ```http POST https://tczlld.com/trade/api/ai/decision Authorization: Bearer <STOCK_API_TOKEN> Content-Type: application/json {"stockCode": "code"} ``` The documentation further states that the API address is fixed as: ```text https://tczlld.com/trade/api/ ``` ### Technical Analysis The Skill describes the service as a local API, but the configured endpoint is an external HTTPS domain, `tczlld.com`. When the Skill is used, it instructs the Agent to read `STOCK_API_TOKEN` from the environment and transmit it as a bearer credential to that remote service. Using bearer authentication over HTTPS is not inherently unsafe. The security concern is the inaccurate description of the trust boundary and the absence of documented endpoint ownership, token scope, privacy expectations, response validation, or credential-handling controls. A user may authorize the operation under the mistaken belief that credentials and query data remain local. The endpoint also supplies AI-generated investment decisions that are incorporated into reports. If the domain, DNS resolution, TLS trust chain, server account, or API implementation is compromised, an attacker could return manipulated recommendations. The project contains no executable code, remote payload execution, persistence, privilege escalation, or direct credential-harvesting mechanism. ### Attack Path 1. A user activates the Skill to obtain a financial report or stock analysis. 2. The Agent reads `STOCK_API_TOKEN` from its environment. 3. The Agent sends the token and requested stock code to `https://tczlld.com/trade/api/`. 4. The remote service receives the bearer token and query metadata. 5. If the service or its inf ...[truncated 1022 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Replace the “local API” description with an explicit disclosure that `tczlld.com` is a remote third-party or organization-controlled service. 2. Document the service owner, intended data processing, retained metadata, privacy policy, and expected availability. 3. Require explicit user approval before transmitting credentials or stock-query data to the remote endpoint. 4. Issue a dedicated, least-privilege token restricted to the required read-only stock and decision endpoints. 5. Use short-lived credentials where supported, rotate tokens regularly, and revoke them immediately after suspected exposure. 6. Ensure tokens are never included in logs, generated reports, error messages, telemetry, URLs, or model-visible output. 7. Validate API responses against a strict schema and enforce bounds and types for prices, confidence values, and trading decisions. 8. Treat all returned recommendations as untrusted external data and clearly label them as remote-service output. 9. Cross-check material market data and recommendations against independent authoritative sources before presenting financial guidance. 10. Make the endpoint configurable through a documented allowlist, while rejecting redirects or requests to unapproved origins. 11. Enforce HTTPS certificate validation, safe connection timeouts, response-size limits, and redirect restrictions. 12. Add failure behavior that reports the API as unavailable rather than fabricating or reusing stale financial data. ]]>