T09 · Insecure Skill Coding Practices
Error
- Location
- scripts/api.js:14
- Finding
- Bearer Token and Private Tandoor Data May Be Transmitted Over Plaintext HTTP## Vulnerability Details **File Location**: `scripts/api.js`, lines 14–54 **Vulnerability Type**: Insecure transmission of sensitive information **Risk Level**: High ### Vulnerable Code ```js function getConfig() { const url = process.env.TANDOOR_URL; const token = process.env.TANDOOR_API_TOKEN; const additionalHeadersRaw = process.env.TANDOOR_ADDITIONAL_HEADERS; if (!url) { throw new Error('TANDOOR_URL environment variable is not set'); } if (!token) { throw new Error('TANDOOR_API_TOKEN environment variable is not set'); } let additionalHeaders; if (additionalHeadersRaw) { try { additionalHeaders = JSON.parse(additionalHeadersRaw); } catch { throw new Error('TANDOOR_ADDITIONAL_HEADERS must be valid JSON'); } } return { url, token, additionalHeaders }; } export async function apiRequest(endpoint, schema, options = {}) { const { url: TANDOOR_URL, token: TANDOOR_API_TOKEN, additionalHeaders: envHeaders } = getConfig(); const { method = 'GET', body, headers: optionHeaders } = options; const url = new URL(endpoint, TANDOOR_URL); const headers = { 'Authorization': `Bearer ${TANDOOR_API_TOKEN}`, 'Accept': 'application/json', ...envHeaders, ...optionHeaders, }; if (body) { headers['Content-Type'] = 'application/json'; } const response = await fetch(url.toString(), { method, headers, body: body ? JSON.stringify(body) : undefined, }); ``` The same behavior is repeated in `apiRequestRaw` at lines 69–86. ### Technical Analysis `TANDOOR_URL` is obtained from the environment and used without validating its URL scheme. The request helpers always attach `TANDOOR_API_TOKEN` as a bearer credential, including when the configured URL uses plaintext `http:`. Bearer t ...[truncated 1895 chars]
- Remediation
- ## Remediation Suggestions 1. Parse and validate `TANDOOR_URL` when loading configuration, and reject every protocol except `https:` by default. ```js const parsedUrl = new URL(url); if (parsedUrl.protocol !== 'https:') { throw new Error('TANDOOR_URL must use HTTPS'); } ``` 2. If plaintext HTTP is required for local development, allow it only through an explicit opt-in and restrict it to loopback hosts such as `127.0.0.1`, `::1`, or `localhost`. Do not permit general private-network HTTP merely because an address appears internal. 3. Normalize and retain the validated URL object rather than reparsing an unvalidated environment string for every request. 4. Ensure redirects cannot disclose credentials to an unintended origin. Prefer disabling automatic redirects or validating the destination origin before resending authenticated requests. 5. Document HTTPS as a mandatory production requirement in `SKILL.md` and `references/API.md`. 6. Use a narrowly scoped Tandoor token where supported, rotate any token that may have been used over HTTP, and avoid granting administrative permissions that the Skill does not require.