T09 · Insecure Skill Coding Practices
Error
- Location
- SKILL.md:41
- Finding
- Game API Communication Uses Unencrypted HTTP<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:41-101, 149-150, 158-184`; `assets/GAME_LOOP.md:11-20, 58-77` **Vulnerability Type**: Plaintext transmission and unauthenticated transport **Risk Level**: High ### Vulnerable Code `SKILL.md:41-43`: ```bash curl -X POST http://5.182.87.148:8080/api/register \ -H "Content-Type: application/json" \ -d '{"address": "YOUR_WALLET_ADDRESS", "name": "YOUR_AGENT_NAME"}' ``` `SKILL.md:70-72`: ```bash curl -X POST http://5.182.87.148:8080/api/game/GAME_ID/action \ -H "Content-Type: application/json" \ -d '{"address": "YOUR_ADDRESS", "action": "MOVE", "target": "ELECTRICAL"}' ``` `SKILL.md:84-93`: ```bash curl -X POST http://5.182.87.148:8080/api/game/GAME_ID/speak \ -H "Content-Type: application/json" \ -d '{"address": "YOUR_ADDRESS", "message": "I saw Blue near Electrical!", "accuse": "Blue"}' curl -X POST http://5.182.87.148:8080/api/game/GAME_ID/vote \ -H "Content-Type: application/json" \ -d '{"address": "YOUR_ADDRESS", "target": "Blue"}' ``` `SKILL.md:101`: ```bash curl "http://5.182.87.148:8080/api/game/GAME_ID/state?address=YOUR_ADDRESS" ``` `assets/GAME_LOOP.md:11-20`: ```python BASE_URL = "http://5.182.87.148:8080" MY_ADDRESS = "0x..." # Your wallet address def play_game(game_id): """Main game loop.""" while True: # 1. Get current state state = requests.get( f"{BASE_URL}/api/game/{game_id}/state", params={"address": MY_ADDRESS} ).json() ``` `assets/GAME_LOOP.md:58-77`: ```python requests.post( f"{BASE_URL}/api/game/{game_id}/action", json={"address": MY_ADDRESS, **action} ) def speak_in_meeting(game_id, state): """Say something during meeting.""" message = "I was doing tasks, didn't see anything suspicious." requests.post( f"{BASE_URL}/api/game/{game_id}/speak", json={"address": MY_ADDRESS, "message": message, "accuse": None} ) def cast_vote(game_id, state): """Vote to ...[truncated 2921 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Replace every `http://5.182.87.148:8080` endpoint with an `https://` endpoint using a stable domain name and a certificate issued by a trusted certificate authority. 2. Configure the server to redirect or reject plaintext HTTP rather than supporting it as a fallback. 3. Retain the default certificate and hostname verification performed by `requests` and `curl`; do not introduce options such as `verify=False` or `curl -k`. 4. Authenticate state-changing operations cryptographically. A recommended design is to have the wallet sign a canonical request containing: - HTTP method and endpoint - Request body hash - Wallet address - Server-issued nonce - Timestamp and expiration - Chain or application domain identifier 5. Verify signatures server-side and bind the recovered signer address to the requested player identity. 6. Use unique, single-use nonces and short expiration windows to prevent replay attacks. 7. Avoid placing identifying data in query strings where it may be retained by proxies and access logs; use authenticated request bodies or headers where appropriate. 8. Add explicit request timeouts, response-status validation, schema validation, and exception handling to the autonomous loop before acting on remote state. 9. Document the service's trust model, data handling, and authentication requirements so users understand that a public wallet address is not itself proof of wallet ownership. ]]>