T09 · Insecure Skill Coding Practices
Error
- Location
- SKILL.md:97
- Finding
- Attacker-Controlled API Destination and Encryption Key Can Enable Migration Data Theft<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:97-113`, `SKILL.md:178-194`, and `SKILL.md:198-221` **Vulnerability Type**: Untrusted destination and recipient-controlled encryption key **Risk Level**: Critical ### Vulnerable Code ```markdown ### Step 1: Collect Information from the User Ask the user for: 1. **Import Token** -- a 64-character hex string from the LaunchThatBot dashboard 2. **API URL** -- the LaunchThatBot API URL (default: `https://api.ltb.it.com`) The user gets the import token by clicking **Import Agent** on their agent's detail page in the LaunchThatBot dashboard. ### Step 2A (Quick API): Fetch the Public Key (Handshake via mcporter) Call LaunchThatBot MCP through `mcporter`: ``` npx -y mcporter call launchthatbot.import_handshake \ importToken:"<importToken>" \ apiUrl:"https://api.ltb.it.com" ``` ``` ```javascript const crypto = require("crypto"); function encryptSecret(value, publicKeyPem) { const encrypted = crypto.publicEncrypt( { key: publicKeyPem, padding: crypto.constants.RSA_PKCS1_OAEP_PADDING, oaepHash: "sha256", }, Buffer.from(value, "utf8"), ); return encrypted.toString("base64"); } ``` ```markdown ### Step 6A (Quick API): Send the Payload (via mcporter) Send everything via LaunchThatBot MCP through `mcporter`: ``` npx -y mcporter call launchthatbot.import_push --args '{ "importToken": "<importToken>", "apiUrl": "https://api.ltb.it.com", "payload": { "config": { "soulMd": "<contents of soul.md>", "memory": [ { "filename": "MEMORY.md", "content": "<file contents>" }, { "filename": "daily-log.json", "content": "<file contents>" } ], "skills": [ { "path": "web-search/SKILL.md", "content": "<file contents>" }, { "path": "email-sender/SKILL.md", "content": "<file contents>" } ] }, "encryptedSecrets": [ { "key": "OPENAI_API_KEY", "ciphertextB64": "<base64 encrypted value>" }, { " ...[truncated 2451 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Remove arbitrary API destination support or enforce an exact allowlist of approved HTTPS origins. 2. Canonicalize and validate the URL before use, rejecting redirects, embedded credentials, nonstandard schemes, IP literals, and lookalike domains. 3. Distribute session metadata signed by a pinned vendor signing key. The signed data should include: - Import token or its cryptographic digest. - Exact API origin. - Target deployment identity. - Public-key fingerprint. - Expiration time. - One-time nonce. 4. Verify the metadata signature locally before reading any sensitive files. 5. Bind the server-side token to the same destination, target deployment, and public key. 6. Display the exact destination, target identity, and public-key fingerprint to the user before collection and require explicit confirmation. 7. Encrypt and authenticate the entire migration payload, including configuration, memory, filenames, and skill contents, rather than encrypting only `.env` values. 8. Reject unverified public keys and fail closed if any identity or signature check cannot be completed. ]]>