T09 · Insecure Skill Coding Practices
Error
- Location
scripts/oil_price.py:55- Finding
API Credential Transmitted Through Unencrypted HTTP
- Content
View full analysis
dict: """Query nationwide oil prices.""" params = {"key": api_key} url = f"{API_URL}?{urllib.parse.urlencode(params)}" try: with urllib.request.urlopen(url, timeout=15) as resp: data = json.loads(resp.read().decode("utf-8")) ``` The insecure endpoint is also explicitly documented at `SKILL.md:73-76`: ```text ### Direct API Call (No Script Required) GET http://apis.juhe.cn/gnyj/query?key=YOUR_KEY ``` ### Technical Analysis The script inserts the Juhe API key into a URL query parameter and transmits the resulting request to an unencrypted HTTP endpoint. HTTP provides neither transport confidentiality nor endpoint integrity. Because the credential appears in the request URL, any network intermediary capable of observing cleartext traffic can recover it. This may include an attacker on the same untrusted network, a compromised router, an ISP-level intermediary, or an HTTP inspection proxy. URLs may also be retained in proxy and server access logs. Even if the server redirects HTTP requests to HTTPS, the initial HTTP request already contains the API key in its request target. Following a subsequent HTTPS redirect therefore does not protect the credential from exposure during the first request. The lack of authenticated transport also allows an active man-in-the-middle attacker to modify the API response. The script trusts the returned JSON and displays the supplied oil-price data without independently authenticating its source. The network request is necessary for the Skill's declared oil-price lookup functionality, and transmission of an API credential to the declared provider is functionally ...[truncated 1674 chars]- Remediation
View remediation