T09 · Insecure Skill Coding Practices
Error
- Location
SKILL.md:5801- Finding
Credentials Transmitted over Plaintext HTTP and Exposed in Request URLs
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 5801 and 5811–5856
Vulnerability Type: Plaintext credential transmission and sensitive information exposure through URL query parameters
Risk Level: HighComplete Code Snippet:
python self.base_url = f"http://{url}:{port}" self.session = requests.Session() self.timeout = 120 def _get_params(self, **kwargs) -> Dict[str, Any]: """Build request parameters and automatically add user authentication information.""" params = { 'user': self.user, 'password': self.password, 'auth_code': self.auth_code, } params.update(kwargs) return params def _request( self, endpoint: str, params: Dict[str, Any], method: str = 'GET', timeout: Optional[int] = None, verbose: bool = True ) -> Dict[str, Any]: if timeout is None: timeout = self.timeout url = f"{self.base_url}{endpoint}" clean_params = {k: v for k, v in params.items() if v is not None} try: if method.upper() == 'GET': response = self.session.get(url, params=clean_params, timeout=timeout) else: response = self.session.post(url, params=clean_params, timeout=timeout) if verbose: print(f"📤 Request URL: {response.url[:100]}...") print(f"📤 Status code: {response.status_code}")Technical Analysis
The client constructs its base endpoint with the unencrypted
http://scheme and automatically adds the user's password and authorization code to every request parameter set. Both GET and POST requests pass these values throughparams, causing them to appear in the URL query string rather than in a protected request body or authentication header.This creates two related exposure channels:
- Network interception: Plaintext HTTP provides neither transport encryption nor reliable server authent ...[truncated 2442 chars]
- Remediation
View remediation
Remediation Suggestions
- Require HTTPS for every API endpoint and reject initialization with an
http://endpoint. Keep certificate verification enabled and do not introduce a bypass such asverify=False. - Remove passwords and authorization codes from query parameters. Use a standard
Authorizationheader with a short-lived token, or place authentication data in a protected POST body when required by the protocol. - Do not send reusable passwords with every request. Exchange credentials once for a scoped, short-lived access token and support revocation and expiration.
- Remove full request-URL logging. If request diagnostics are necessary, log only the scheme, host, path, status code, and a sanitized parameter-name list. Explicitly redact
password,auth_code, tokens, cookies, and authorization headers. - Ensure reverse proxies, API gateways, application servers, and telemetry systems also redact sensitive headers and parameters.
- Store credentials outside source code and notebooks, such as in a protected secret manager or environment-based credential provider. Avoid defaults that resemble usable credentials.
- Rotate passwords and authorization codes that may already have been transmitted or logged by this implementation, and purge exposed logs according to the applicable retention policy.
- Add automated tests that fail if credentials appear in generated URLs, logs, exception messages, or telemetry.
- Apply server-side rate limiting, token scoping, anomaly detection, and reauthentication for destructive operations. Require a separate confirmation mechanism for irreversible deletion requests.
- Require HTTPS for every API endpoint and reject initialization with an