T09 · Insecure Skill Coding Practices
- Location
SKILL.md:139- Finding
Production PHP integrations are permitted despite disabled TLS certificate verification
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 139-141
Vulnerability Type: TLS certificate verification disabled in a prescribed production dependency
Risk Level: HighRelevant excerpt (English translation):
text - The local SDK review found that the PHP 2.0.31 SDK still sets CURLOPT_SSL_VERIFYPEER=false. This is treated as a non-blocking warning rather than a prerequisite for continuing to use the official SDK. - Generated business code must not add trust-all, verify=false, or other settings that disable TLS verification, and must not automatically modify the user's SDK. An existing TLS issue in the designated SDK is only reported as a warning and does not stop implementation.The same policy is reinforced in
SKILL.md:153-154, which permits continued use of PHP SDK 2.0.31 for integration or production work while treating its TLS condition as non-blocking.Technical Analysis
The Skill explicitly records that the prescribed PHP SDK sets
CURLOPT_SSL_VERIFYPEER=false. This disables validation of the remote server's certificate chain. Although the Skill prohibits generated code from introducing additional trust-all behavior, it knowingly permits production code to continue using a dependency whose existing transport implementation already disables peer verification.HTTPS encryption without certificate authentication does not reliably establish the identity of the remote payment endpoint. A network-positioned attacker can present an arbitrary certificate and terminate the connection without possessing a certificate trusted for the intended API hostname.
This path is reachable when a user requests runnable PHP integration or production code and follows the Skill's SDK-first instructions. The Skill does not require remediation or verified secure transport before continuing.
Attack Path
- A user requests runnable PHP onboarding or production integration code.
- T ...[truncated 1451 chars]
- Remediation
View remediation
Remediation Suggestions
- Do not generate or approve production PHP integrations that use an HTTP client with certificate verification disabled.
- Require a patched SDK version or secure transport adapter that validates both the certificate chain and the requested hostname.
- Verify the installed SDK source and runtime cURL options rather than relying solely on a version number.
- Add a fail-closed preflight check that rejects production execution when
CURLOPT_SSL_VERIFYPEERis false or hostname verification is disabled. - Preserve request signing and response verification while correcting the TLS transport; application-layer signatures are not a substitute for authenticated TLS.
- Add an integration test using an untrusted certificate and confirm that the connection is rejected.
- Treat inability to establish verified TLS as a hard stop for production and live integration traffic, rather than as a non-blocking warning.