T09 · Insecure Skill Coding Practices
Error
- Location
- SKILL.md:38
- Finding
- Game API Uses Plaintext HTTP Without Demonstrated Request Authentication<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:38-44` **Additional Locations**: `SKILL.md:47-108, 139-177`; `assets/GAME_LOOP.md:7-70` **Vulnerability Type**: Plaintext transport and insufficiently documented API authentication **Risk Level**: High ### Vulnerable Code ```bash curl -X POST http://5.182.87.148:8080/api/register \ -H "Content-Type: application/json" \ -d '{"address": "YOUR_WALLET_ADDRESS", "name": "YOUR_AGENT_NAME"}' ``` The same plaintext endpoint is used for state retrieval and state-changing operations: ```bash curl -X POST http://5.182.87.148:8080/api/game/GAME_ID/action \ -H "Content-Type: application/json" \ -d '{"address": "YOUR_ADDRESS", "action": "MOVE", "target": "ELECTRICAL"}' curl "http://5.182.87.148:8080/api/game/GAME_ID/state?address=YOUR_ADDRESS" ``` The autonomous client also hardcodes the plaintext endpoint: ```python BASE_URL = "http://5.182.87.148:8080" MY_ADDRESS = "0x..." # Your wallet address state = requests.get( f"{BASE_URL}/api/game/{game_id}/state", params={"address": MY_ADDRESS} ).json() ``` ### Technical Analysis The documented API uses HTTP rather than HTTPS. Consequently, the client receives no transport encryption, server identity validation, or protection against modification by an on-path attacker. Wallet addresses, game state, meeting statements, votes, and gameplay actions can be observed or altered in transit. The documented state-changing requests identify an agent using only its public wallet address. They do not demonstrate a cryptographic signature, session credential, nonce, or other proof that the caller controls the wallet. If the service implements the documented interface without an additional unshown authentication layer, knowledge of a public wallet address is sufficient to impersonate an agent and submit actions on its behalf. The autonomous loop trusts JSON received from the unauthenticated HTTP service. An attacker able to manipulate traffic could cha ...[truncated 1525 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Replace every `http://` API and dashboard URL with an `https://` endpoint using a valid certificate and an authenticated domain name. 2. Do not disable TLS certificate verification in clients. 3. Require cryptographic wallet authentication: - Have the server issue a short-lived, single-use nonce. - Sign a domain-separated authentication message with the wallet. - Verify the signature and address server-side. - Exchange the verified signature for a short-lived, narrowly scoped session token. 4. Bind each action to the authenticated session, game identifier, expected phase, and a unique nonce or sequence number to prevent replay. 5. Do not accept a client-supplied address as sufficient authorization for state-changing operations. 6. Validate HTTP status codes, content types, response sizes, schemas, phases, locations, and player identifiers before using response data. 7. Configure explicit connection and read timeouts, bounded retries, and safe handling of malformed responses. 8. Avoid placing wallet addresses in query strings where they can be retained in proxy and server logs; use an authenticated request context instead. 9. Document the service operator, trust boundary, privacy behavior, and authentication guarantees before encouraging autonomous use. ]]>