T09 · Insecure Skill Coding Practices
- Location
scripts/zhejiang_ccgp.py:9- Finding
Unencrypted HTTP Retrieval of Agent-Consumed Procurement Data
- Content
View full analysis
Vulnerability Details
File Location:
scripts/zhejiang_ccgp.py, lines 9, 31–38, and 90
Vulnerability Type: Unencrypted network communication and insufficient response-integrity protection
Risk Level: MediumVulnerable Code
python API_URL = "http://www.ccgp-zhejiang.gov.cn/portal/searchHome"python req = urllib.request.Request( API_URL, data=payload, headers={ "User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36", "Accept": "application/json", "Content-Type": "application/json", "Referer": "http://www.ccgp-zhejiang.gov.cn/" } ) try: with urllib.request.urlopen(req, timeout=15) as resp: data = json.loads(resp.read().decode())python link = f"http://www.ccgp-zhejiang.gov.cn/site/detail?articleId={article_id}" if article_id else ""Technical Analysis
The procurement API and generated detail links use plaintext HTTP. HTTP does not provide transport confidentiality, server authentication, or response integrity. A network-positioned attacker can intercept and modify the JSON response before the script parses it.
Remote fields such as
title,purchaseName,districtName, dates, andarticleIdare accepted without authenticity verification and incorporated into the generated intelligence report. Although the script does not execute response content as code, altered content can be presented to users or passed into subsequent Agent processing. This creates an integrity risk and may expose the Agent to misleading or instruction-like text originating from a manipulated response.The fixed AIBase and IT Home links in
SKILL.mdandreferences/data-sources.mdare relevant to the declared news-collection function. They contain no referral parameters, promotional directives, or unrelated traffic-diversion instructions and therefore are not classified as instruction hijacking.Attac
...[truncated 1406 chars]
- Remediation
View remediation
Remediation Suggestions
- Replace the API URL, detail-link URL, and
Refererwith verified HTTPS equivalents supported by the official service. - Reject redirects whose final destination is not HTTPS or whose hostname is outside an explicit allowlist.
- Retain normal TLS certificate and hostname verification; do not introduce permissive SSL contexts.
- Validate the response content type, top-level JSON structure, expected field types, identifier format, and reasonable field-length limits before processing.
- Escape or clearly delimit all fetched values when including them in Agent prompts, and explicitly instruct the Agent that retrieved content is untrusted data rather than executable instructions.
- Prefer structured data transfer between the script and report generator instead of interpolating untrusted remote text into free-form prompts.
- If the official endpoint does not support HTTPS, use an authenticated trusted intermediary or another official TLS-protected source and document the residual integrity risk.
- Replace the API URL, detail-link URL, and