T09 · Insecure Skill Coding Practices
Warning
- Location
- SKILL.md:48
- Finding
- Misleading HSTS Security Guidance## Vulnerability Details **File Location**: `SKILL.md`, line 48 **Vulnerability Type**: Insecure security configuration guidance **Risk Level**: Medium **Complete Snippet**: ```markdown ## Security Headers - Caddy doesn't add security headers by default — add X-Frame-Options, X-Content-Type-Options explicitly - HSTS is automatic when serving HTTPS — no manual configuration needed ``` ### Technical Analysis The Skill claims that HSTS is enabled automatically whenever Caddy serves HTTPS. Caddy's automatic HTTPS functionality manages TLS certificates and HTTP-to-HTTPS redirects, but it does not guarantee that responses include the `Strict-Transport-Security` header. An agent or administrator relying on this instruction may omit explicit HSTS configuration and verification. HTTPS redirects do not provide the same protection as HSTS because a browser's initial HTTP request can occur before it learns that the domain must only be accessed over HTTPS. ### Attack Path 1. An agent or administrator follows the guidance in `SKILL.md`. 2. Based on the assertion that HSTS is automatic, they do not configure a `Strict-Transport-Security` response header. 3. The service is deployed with HTTPS and HTTP-to-HTTPS redirects but without HSTS. 4. A user makes an initial HTTP request from a network controlled or observed by an on-path attacker. 5. Before the browser reaches the HTTPS redirect, the attacker may intercept or manipulate the HTTP connection and attempt an SSL-stripping or downgrade attack. ### Impact Assessment This issue does not directly grant local system privileges or compromise the Caddy host. Its scope is limited to services configured according to the inaccurate guidance. In affected deployments, an on-path attacker may target users who have not previously established an HSTS policy for the domain, potentially exposing or manipulating traffic sent during a downgraded initial connection. Existing browser HSTS state, HS ...[truncated 96 chars]
- Remediation
- ## Remediation Suggestions Replace the inaccurate statement with guidance requiring administrators to configure and verify HSTS explicitly. For example: ```caddyfile example.com { header Strict-Transport-Security "max-age=31536000" reverse_proxy localhost:3000 } ``` Begin with a conservative `max-age` during testing and increase it after confirming that HTTPS works reliably. Add `includeSubDomains` only when every relevant subdomain supports HTTPS. Enable `preload` and request browser preload registration only after validating the long-term operational consequences. Verify the deployed response rather than relying only on configuration: ```sh curl -I https://example.com ``` Confirm that the response contains the intended `Strict-Transport-Security` header. Validate the Caddy configuration with `caddy validate` before applying it.