T09 · Insecure Skill Coding Practices
Error
- Location
SKILL.md:15- Finding
Bearer API Key May Be Transmitted over Plaintext HTTP
- Content
View full analysis
API Keys All requests use `Authorization: Bearer $EDGEBRIC_API_KEY` header. ``` ### Technical Analysis The skill allows an `http://` API base URL and instructs the agent to attach `EDGEBRIC_API_KEY` as a bearer token to every request. The documentation does not require HTTPS or restrict plaintext HTTP to loopback addresses. HTTP provides neither transport confidentiality nor authenticated encryption. If an HTTP URL points to a non-loopback host, any attacker able to observe or modify the network path may capture the bearer credential, inspect private knowledge-base content, or tamper with API responses. Because a bearer token can generally be reused by whoever possesses it, interception may result in direct account or API access without obtaining another authentication factor. The practical severity depends on configuration. An HTTP service strictly bound to the local loopback interface has a substantially smaller network interception surface, while HTTP over a LAN, public network, proxy, container network, or untrusted host creates a high-risk credential exposure condition. ### Attack Path 1. A user or deployment configures `EDGEBRIC_URL` with an HTTP URL that is not securely confined to the local loopback interface. 2. The agent sends a request to that URL with `Authorization: Bearer $EDGEBR ...[truncated 1090 chars]- Remediation
View remediation