T09 · Insecure Skill Coding Practices
- Location
scripts/api.js:14- Finding
Bearer Token and Private Tandoor Data May Be Transmitted Over Plaintext HTTP
- Content
View full analysis
Vulnerability Details
File Location:
scripts/api.js, lines 14–54
Vulnerability Type: Insecure transmission of sensitive information
Risk Level: HighVulnerable Code
js function getConfig() { const url = process.env.TANDOOR_URL; const token = process.env.TANDOOR_API_TOKEN; const additionalHeadersRaw = process.env.TANDOOR_ADDITIONAL_HEADERS; if (!url) { throw new Error('TANDOOR_URL environment variable is not set'); } if (!token) { throw new Error('TANDOOR_API_TOKEN environment variable is not set'); } let additionalHeaders; if (additionalHeadersRaw) { try { additionalHeaders = JSON.parse(additionalHeadersRaw); } catch { throw new Error('TANDOOR_ADDITIONAL_HEADERS must be valid JSON'); } } return { url, token, additionalHeaders }; } export async function apiRequest(endpoint, schema, options = {}) { const { url: TANDOOR_URL, token: TANDOOR_API_TOKEN, additionalHeaders: envHeaders } = getConfig(); const { method = 'GET', body, headers: optionHeaders } = options; const url = new URL(endpoint, TANDOOR_URL); const headers = { 'Authorization': `Bearer ${TANDOOR_API_TOKEN}`, 'Accept': 'application/json', ...envHeaders, ...optionHeaders, }; if (body) { headers['Content-Type'] = 'application/json'; } const response = await fetch(url.toString(), { method, headers, body: body ? JSON.stringify(body) : undefined, });The same behavior is repeated in
apiRequestRawat lines 69–86.Technical Analysis
TANDOOR_URLis obtained from the environment and used without validating its URL scheme. The request helpers always attachTANDOOR_API_TOKENas a bearer credential, including when the configured URL uses plaintexthttp:.Bearer t ...[truncated 1895 chars]
- Remediation
View remediation
Remediation Suggestions
-
Parse and validate
TANDOOR_URLwhen loading configuration, and reject every protocol excepthttps:by default.js const parsedUrl = new URL(url); if (parsedUrl.protocol !== 'https:') { throw new Error('TANDOOR_URL must use HTTPS'); } -
If plaintext HTTP is required for local development, allow it only through an explicit opt-in and restrict it to loopback hosts such as
127.0.0.1,::1, orlocalhost. Do not permit general private-network HTTP merely because an address appears internal. -
Normalize and retain the validated URL object rather than reparsing an unvalidated environment string for every request.
-
Ensure redirects cannot disclose credentials to an unintended origin. Prefer disabling automatic redirects or validating the destination origin before resending authenticated requests.
-
Document HTTPS as a mandatory production requirement in
SKILL.mdandreferences/API.md. -
Use a narrowly scoped Tandoor token where supported, rotate any token that may have been used over HTTP, and avoid granting administrative permissions that the Skill does not require.
-