T09 · Insecure Skill Coding Practices
- Location
scripts/fetch_explosive_covers.py:69- Finding
TLS Certificate and Hostname Validation Are Disabled
- Content
View full analysis
Vulnerability Details
File Location:
scripts/fetch_explosive_covers.py, lines 69-77
Vulnerability Type: Improper certificate validation in a custom HTTPS client
Risk Level: HighVulnerable code:
python # Create TCP connection sock = socket.create_connection((host, 443), timeout=timeout) # Create SSL context without SNI context = ssl.SSLContext(ssl.PROTOCOL_TLSv1_2) context.check_hostname = False context.verify_mode = ssl.CERT_NONE # Wrap socket without server_hostname to avoid sending SNI ssl_sock = context.wrap_socket(sock)Technical Analysis
The custom HTTPS implementation explicitly disables certificate-chain validation by setting
verify_modetossl.CERT_NONE. It also disables hostname verification and omitsserver_hostnamewhen wrapping the socket.TLS encryption without server authentication does not establish that the client is communicating with the intended API. Any certificate, including a self-signed certificate controlled by an attacker, will be accepted. A network-positioned attacker can therefore impersonate
onetotenvip.com, inspect user-derived query keywords, and modify the API response.This issue is compounded by the later workflow, which trusts returned post metadata and cover-image URLs. A forged API response can consequently influence both the generated analysis and subsequent network requests made by image-analysis tooling.
Attack Path
- A user invokes the Skill with a topic or set of keywords.
- The script opens a connection to the configured third-party API.
- An attacker with a suitable network position intercepts or redirects that connection.
- The attacker presents an arbitrary TLS certificate.
- The client accepts the certificate because certificate and hostname verification are disabled.
- The attacker reads the submitted keywords and returns attacker-controlled JSON.
- The forged response can contain fabricated engagement ...[truncated 786 chars]
- Remediation
View remediation
Remediation Suggestions
- Replace the raw socket-based HTTPS implementation with a standard verified client such as
requests:python response = requests.get( base_url, params=params, headers=headers, timeout=(5, 60), ) response.raise_for_status() data = response.json() - Do not pass
verify=False; use the operating system orcertifitrust store. - Require normal SNI and hostname validation. If the remote server fails when SNI is enabled, correct or replace the server rather than weakening TLS.
- Fail closed on certificate, hostname, protocol, and response-parsing errors.
- Consider certificate or public-key pinning if the service is controlled by the project and operational key rotation can be managed safely.
- Add automated tests verifying that expired, self-signed, wrong-host, and untrusted certificates are rejected.
- Apply URL allowlisting to fields returned by the API so that transport compromise cannot freely redirect subsequent Agent requests.
- Replace the raw socket-based HTTPS implementation with a standard verified client such as