T09 · Insecure Skill Coding Practices
Error
- Location
SKILL.md:5242- Finding
Credentials Transmitted and Logged Through Plaintext HTTP Query Strings
- Content
View full analysis
Dict[str, Any]: """Build request parameters and automatically add authentication information.""" params = { 'user': self.user, 'password': self.password, 'auth_code': self.auth_code, } params.update(kwargs) return params def _request( self, endpoint: str, params: Dict[str, Any], method: str = 'GET', timeout: Optional[int] = None, verbose: bool = True ) -> Dict[str, Any]: if timeout is None: timeout = self.timeout url = f"{self.base_url}{endpoint}" clean_params = {k: v for k, v in params.items() if v is not None} try: if method.upper() == 'GET': response = self.session.get( url, params=clean_params, timeout=timeout ) else: response = self.session.post( url, params=clean_params, timeout=timeout ) if verbose: print(f"Request URL: {response.url[:100]}...") print(f"Status code: {response.status_code}") ``` ### Technical Analysis The client uses unencrypted HTTP while automatically adding the user's password and authorization code to every request. For GET requests, `requests` serializes these values into the URL query string. The POST branch also uses the `params` argument, so its credentials are likewise placed in the query string rather than the request body. This design creates two related exposure channels: 1. Plaintext HTTP provides no transport confidentiality or server authentication. An attacker capable of observing or modifying t ...[truncated 1745 chars]- Remediation
View remediation