T09 · Insecure Skill Coding Practices
Warning
- Location
- SKILL.md:25
- Finding
- API credentials and inference data may be transmitted to remote servers over plaintext HTTP## Vulnerability Details **File Location**: `SKILL.md:25-28, 38-42` **Additional Affected Locations**: The same plaintext HTTP and authorization-header pattern is repeated in the API examples throughout `SKILL.md`. **Vulnerability Type**: Transmission of sensitive information over an insecure channel **Risk Level**: Medium ### Vulnerable Code ```markdown 1. Every endpoint requires a base `server_url`. If one is not specified by the user, assume `http://localhost:8000`. 2. Use the `LEMONADE_API_KEY` environment variable to authenticate. 3. This skill stays focused on making HTTP requests to a base `server_url` (default `http://localhost:8000`) and using an optional `LEMONADE_API_KEY`. It does not instruct reading arbitrary host files or other env vars. 4. **Operational note:** The skill will transmit prompts and model requests to whichever `server_url` is used. If a remote URL is supplied, the agent will send user content and model commands there (expected for this skill, but worth the user's attention). ## API Operations ### System Info Get hardware capabilities and device enumeration limits. **Returns:** JSON object with hardware capabilities. ```bash # Example Request curl -X GET "http://localhost:8000/api/v1/system-info" \ -H "Authorization: Bearer ${LEMONADE_API_KEY}" ``` ``` ### Technical Analysis The skill supports user-selected local or remote server URLs and instructs the agent to attach the `LEMONADE_API_KEY` bearer token to HTTP requests. It does not require TLS for non-loopback destinations, validate the destination, or instruct the agent to reject plaintext remote URLs. The examples consistently normalize the use of the `http://` scheme. Plaintext HTTP provides neither confidentiality nor server authentication. When this pattern is used with a remote server, a network-positioned attacker can observe or modify the request and capture the bearer token. An attacker who persuades a user to selec ...[truncated 1677 chars]
- Remediation
- ## Remediation Suggestions 1. Require `https://` for every non-loopback server URL. Permit plaintext HTTP only for explicitly recognized loopback destinations such as `localhost`, `127.0.0.1`, and `[::1]`. 2. Validate the URL before making a request. Reject unsupported schemes, embedded credentials, malformed hosts, and unexpected redirects. 3. Do not forward the `Authorization` header across redirects or to a host different from the one explicitly approved by the user. Prefer disabling redirects unless they are required. 4. Ask for explicit user confirmation before sending credentials, prompts, or model-management commands to a new remote origin. 5. Maintain an allowlist of trusted Lemonade server origins where feasible. 6. Omit the `Authorization` header entirely when `LEMONADE_API_KEY` is unset or empty. 7. Replace remote HTTP examples with HTTPS examples and clearly document that TLS certificate validation must not be disabled. 8. Use narrowly scoped, short-lived API credentials and rotate any credential suspected of having traversed plaintext HTTP. 9. Consider separating read-only monitoring credentials from credentials allowed to pull, load, or unload models.