T09 · Insecure Skill Coding Practices
Warning
- Location
- scripts/zhejiang_ccgp.py:9
- Finding
- Unencrypted HTTP Retrieval of Agent-Consumed Procurement Data## Vulnerability Details **File Location**: `scripts/zhejiang_ccgp.py`, lines 9, 31–38, and 90 **Vulnerability Type**: Unencrypted network communication and insufficient response-integrity protection **Risk Level**: Medium ### Vulnerable Code ```python API_URL = "http://www.ccgp-zhejiang.gov.cn/portal/searchHome" ``` ```python req = urllib.request.Request( API_URL, data=payload, headers={ "User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36", "Accept": "application/json", "Content-Type": "application/json", "Referer": "http://www.ccgp-zhejiang.gov.cn/" } ) try: with urllib.request.urlopen(req, timeout=15) as resp: data = json.loads(resp.read().decode()) ``` ```python link = f"http://www.ccgp-zhejiang.gov.cn/site/detail?articleId={article_id}" if article_id else "" ``` ### Technical Analysis The procurement API and generated detail links use plaintext HTTP. HTTP does not provide transport confidentiality, server authentication, or response integrity. A network-positioned attacker can intercept and modify the JSON response before the script parses it. Remote fields such as `title`, `purchaseName`, `districtName`, dates, and `articleId` are accepted without authenticity verification and incorporated into the generated intelligence report. Although the script does not execute response content as code, altered content can be presented to users or passed into subsequent Agent processing. This creates an integrity risk and may expose the Agent to misleading or instruction-like text originating from a manipulated response. The fixed AIBase and IT Home links in `SKILL.md` and `references/data-sources.md` are relevant to the declared news-collection function. They contain no referral parameters, promotional directives, or unrelated traffic-diversion instructions and therefore are not classified as instruction hijacking. ### Attac ...[truncated 1406 chars]
- Remediation
- ## Remediation Suggestions 1. Replace the API URL, detail-link URL, and `Referer` with verified HTTPS equivalents supported by the official service. 2. Reject redirects whose final destination is not HTTPS or whose hostname is outside an explicit allowlist. 3. Retain normal TLS certificate and hostname verification; do not introduce permissive SSL contexts. 4. Validate the response content type, top-level JSON structure, expected field types, identifier format, and reasonable field-length limits before processing. 5. Escape or clearly delimit all fetched values when including them in Agent prompts, and explicitly instruct the Agent that retrieved content is untrusted data rather than executable instructions. 6. Prefer structured data transfer between the script and report generator instead of interpolating untrusted remote text into free-form prompts. 7. If the official endpoint does not support HTTPS, use an authenticated trusted intermediary or another official TLS-protected source and document the residual integrity risk.