T09 · Insecure Skill Coding Practices
Error
- Location
- SKILL.md:5801
- Finding
- Credentials Transmitted over Plaintext HTTP and Exposed in Request URLs## Vulnerability Details **File Location**: `SKILL.md`, lines 5801 and 5811–5856 **Vulnerability Type**: Plaintext credential transmission and sensitive information exposure through URL query parameters **Risk Level**: High **Complete Code Snippet**: ```python self.base_url = f"http://{url}:{port}" self.session = requests.Session() self.timeout = 120 def _get_params(self, **kwargs) -> Dict[str, Any]: """Build request parameters and automatically add user authentication information.""" params = { 'user': self.user, 'password': self.password, 'auth_code': self.auth_code, } params.update(kwargs) return params def _request( self, endpoint: str, params: Dict[str, Any], method: str = 'GET', timeout: Optional[int] = None, verbose: bool = True ) -> Dict[str, Any]: if timeout is None: timeout = self.timeout url = f"{self.base_url}{endpoint}" clean_params = {k: v for k, v in params.items() if v is not None} try: if method.upper() == 'GET': response = self.session.get(url, params=clean_params, timeout=timeout) else: response = self.session.post(url, params=clean_params, timeout=timeout) if verbose: print(f"📤 Request URL: {response.url[:100]}...") print(f"📤 Status code: {response.status_code}") ``` ### Technical Analysis The client constructs its base endpoint with the unencrypted `http://` scheme and automatically adds the user's password and authorization code to every request parameter set. Both GET and POST requests pass these values through `params`, causing them to appear in the URL query string rather than in a protected request body or authentication header. This creates two related exposure channels: 1. **Network interception:** Plaintext HTTP provides neither transport encryption nor reliable server authent ...[truncated 2442 chars]
- Remediation
- ## Remediation Suggestions 1. Require HTTPS for every API endpoint and reject initialization with an `http://` endpoint. Keep certificate verification enabled and do not introduce a bypass such as `verify=False`. 2. Remove passwords and authorization codes from query parameters. Use a standard `Authorization` header with a short-lived token, or place authentication data in a protected POST body when required by the protocol. 3. Do not send reusable passwords with every request. Exchange credentials once for a scoped, short-lived access token and support revocation and expiration. 4. Remove full request-URL logging. If request diagnostics are necessary, log only the scheme, host, path, status code, and a sanitized parameter-name list. Explicitly redact `password`, `auth_code`, tokens, cookies, and authorization headers. 5. Ensure reverse proxies, API gateways, application servers, and telemetry systems also redact sensitive headers and parameters. 6. Store credentials outside source code and notebooks, such as in a protected secret manager or environment-based credential provider. Avoid defaults that resemble usable credentials. 7. Rotate passwords and authorization codes that may already have been transmitted or logged by this implementation, and purge exposed logs according to the applicable retention policy. 8. Add automated tests that fail if credentials appear in generated URLs, logs, exception messages, or telemetry. 9. Apply server-side rate limiting, token scoping, anomaly detection, and reauthentication for destructive operations. Require a separate confirmation mechanism for irreversible deletion requests.