T09 · Insecure Skill Coding Practices
Error
- Location
SKILL.md:5684- Finding
Credentials and financial queries are transmitted in plaintext URL query parameters
- Content
View full analysis
Dict[str, Any]: """Build request parameters and automatically add authentication data.""" params = { 'user': self.user, 'password': self.password, 'auth_code': self.auth_code, } params.update(kwargs) return params def _request( self, endpoint: str, params: Dict[str, Any], method: str = 'GET', timeout: Optional[int] = None, verbose: bool = True ) -> Dict[str, Any]: if timeout is None: timeout = self.timeout url = f"{self.base_url}{endpoint}" clean_params = {k: v for k, v in params.items() if v is not None} try: if method.upper() == 'GET': response = self.session.get( url, params=clean_params, timeout=timeout ) else: response = self.session.post( url, params=clean_params, timeout=timeout ) if verbose: print(f"Request URL: {response.url[:100]}...") print(f"Status code: {response.status_code}") response.raise_for_status() return response.json() ``` ### Technical Analysis The API base URL is forcibly constructed with `http://`, so transport encryption and server authentication are not provided. The `_get_params()` method systematically adds the account password and authorization code to every authenticated request. The default request method is GET, and `requests` serializes `clean_params` into the URL query string. Consequently, credentials and operation parameters can be exposed through: - Network traffic inspe ...[truncated 2034 chars]- Remediation
View remediation