T09 · Insecure Skill Coding Practices
- Location
references/iam-policies.md:94- Finding
IAM credentials are transmitted with TLS certificate verification disabled
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md:389andreferences/iam-policies.md:94-112
Vulnerability Type: Improper certificate validation during authentication
Risk Level: HighVulnerable Code
SKILL.md:389mandates the following IAM token request:python resp = requests.post( 'https://iam.<region>.myhuaweicloud.com/v3/auth/tokens', json=<IAM request body>, verify=False, timeout=30 )The complete authentication flow in
references/iam-policies.md:94-112is:python import requests, urllib3 urllib3.disable_warnings() url = 'https://iam.<region>.myhuaweicloud.com/v3/auth/tokens' payload = { 'auth': { 'identity': { 'methods': ['password'], 'password': { 'user': { 'name': '<IAM username>', 'password': '<login password>', 'domain': {'name': '<account name>'} } } }, 'scope': {'project': {'name': '<region>'}} } } resp = requests.post(url, json=payload, verify=False, timeout=30)Technical Analysis
The Skill instructs the agent to collect a Huawei Cloud account name, IAM username, and login password and submit them to the IAM token endpoint. The request explicitly uses
verify=False, while warning suppression conceals the resulting insecure-request warning.Disabling certificate verification removes server authentication from TLS. The documented hostname allowlist only constrains the intended URL string; it does not prove that the peer receiving the credentials is the authentic Huawei Cloud IAM server. An active network intermediary can therefore present an arbitrary certificate and terminate the connection without detection.
This is especially significant because the transmitted request contains reusable login credentials rather than only a short-lived token. The behavior is reachable whenever the user selects API deployment and chooses usern ...[truncated 1373 chars]
- Remediation
View remediation
Remediation Suggestions
- Remove
verify=Falseandurllib3.disable_warnings()from the IAM authentication example. - Use Requests’ default certificate verification:
python resp = requests.post(url, json=payload, timeout=30) resp.raise_for_status()- In environments using an authorized TLS inspection proxy, require an explicitly configured enterprise CA bundle rather than disabling verification:
python resp = requests.post( url, json=payload, verify="/path/to/enterprise-ca-bundle.pem", timeout=30, )- Support standard trust-store configuration such as
REQUESTS_CA_BUNDLEand document how administrators can install the enterprise proxy CA. - If certificate validation fails, stop before transmitting credentials and instruct the user to repair the trust configuration. Do not automatically retry with verification disabled.
- Update
SKILL.mdso its mandatory token-acquisition procedure requires verified TLS and remove blanket instructions to bypass certificate verification for authenticated requests. - Prefer short-lived or delegated credentials where available, and grant the IAM identity only the minimum permissions needed for the deployment workflow.
- Remove