T09 · Insecure Skill Coding Practices
Error
- Location
scripts/clawpaw_controller.py:60- Finding
Privileged Android Control Uses Unauthenticated Cleartext HTTP
- Content
View full analysis
str: """ 获取当前界面布局（XML） Returns: 解码后的 XML 布局字符串 """ resp = requests.get(f"{self.base_url}/api/layout", timeout=self.timeout) data = resp.json() layout_b64 = data.get("layout", "") return base64.b64decode(layout_b64).decode("utf-8", errors="ignore") ``` ```python def get_screenshot(self, save_path: Optional[str] = None) -> bytes: """ 获取截图 Args: save_path: 可选，保存截图到文件 Returns: 截图的 PNG 数据 """ resp = requests.get(f"{self.base_url}/api/screenshot", timeout=self.timeout) data = resp.json() screenshot_b64 = data.get("screenshot", "") png_data = base64.b64decode(screenshot_b64) if save_path: with open(save_path, "wb") as f: f.write(png_data) return png_data ``` ```python def execute(self, action: str, **kwargs) -> Dict[str, Any]: """ 执行命令 Args: action: 动作类型 (click, input_text, swipe, back, open_amap, screenshot, get_layout) **kwargs: 动作参数 Returns: 执行结果 """ payload = {"action": action, **kwargs} resp = requests.post( f"{self.base_url}/api/execute", json=payload, timeout=self.timeout ) return resp.json() ``` ### Technical Analysis The direct-control client constructs every device API URL with the `http://` scheme. It does not attach an authentication token, verify a server identity, encrypt the transport, or implement request integrity and replay protection. These API requests can contain or return highly sensitive information, including: - Screen captures and accessibility layout XML - Text entered into applications - Location, notific ...[truncated 1985 chars]- Remediation
View remediation