T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:42- Finding
Payment Proof Exposed Through Verbose HTTP Logging
- Content
View full analysis
" "https://flywise.win/api/ai-pay/flights?from=PEK&to=SHA&date=2026-05-10&cabin=economy&max_results=3" ``` ### Technical Analysis The authenticated request uses `curl -v` while supplying the payment credential through the `Payment-Proof` request header. Curl's verbose mode writes outgoing request headers to diagnostic output. Consequently, the payment proof may be recorded in terminal output, agent execution traces, centralized logs, debugging systems, or observability infrastructure. A payment proof is authentication material used to authorize access to a paid resource. It must therefore be handled as a secret regardless of the low transaction price. The document does not establish that the proof is single-use, short-lived, cryptographically bound to the exact route and parameters, or protected against replay. The vulnerability does not itself provide operating-system privileges. Its exploitability depends on an attacker obtaining access to verbose output and on the server accepting the disclosed proof more than once or outside its intended request context. ### Attack Path 1. A user initiates the documented flight search and completes payment. 2. The payment service returns a valid `Payment-Proof` credential. 3. The agent executes the documented authenticated command with `curl -v`. 4. Curl emits the complete outgoing `Payment-Proof` header to diagnostic output. 5. That output is retained in an agent trace, terminal recording, suppo ...[truncated 838 chars]- Remediation
View remediation