T09 · Insecure Skill Coding Practices
Error
- Location
scripts/fred_query.py:12- Finding
Global TLS Certificate Verification Disabled for Authenticated FRED Requests
- Content
View full analysis
Fred: api_key = os.getenv("FRED_API_KEY") if not api_key: raise SystemExit("Missing FRED_API_KEY in environment") return Fred(api_key=api_key) ``` ### Technical Analysis The script globally replaces Python's default HTTPS context factory with `ssl._create_stdlib_context`. In this context, that compatibility factory creates an unverified TLS context, disabling normal certificate-chain and hostname verification for HTTPS connections made by the process. Network access to the FRED service is necessary for the Skill's declared functionality. Disabling certificate verification is not necessary and exceeds the minimum security relaxation required to perform that function. Because the same process supplies `FRED_API_KEY` to `fredapi`, authenticated API requests can be exposed to an active network attacker. This is a process-wide change rather than a narrowly scoped connection setting. Therefore, any library in the same process that relies on Python's default HTTPS context may also inherit the insecure behavior. ### Attack Path 1. A user runs `scripts/fred_query.py` with `FRED_API_KEY` present in the environment. 2. The script globally installs an unverified default HTTPS context. 3. The script initializes `fredapi` with the API key and performs an HTTPS request. 4. An attacker capable of intercepting traffic, such as a malicious proxy, compromised gateway, or hostile wireless-network operator, presents an arbitrary certificate. 5. The client accepts the certificate without validating its chain or hostname. 6. The att ...[truncated 815 chars]- Remediation
View remediation