T09 · Insecure Skill Coding Practices
- Location
SKILL.md:5324- Finding
Authentication Credentials Transmitted over Plaintext HTTP in URL Parameters
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 5324-5327 and 5337-5374
Vulnerability Type: Plaintext credential transmission and sensitive data exposure
Risk Level: HighVulnerable Code
python self.password = password self.auth_code = auth_code self.base_url = f"http://{url}:{port}" self.session = requests.Session() self.timeout = 120python def _get_params(self, **kwargs) -> Dict[str, Any]: params = { 'user': self.user, 'password': self.password, 'auth_code': self.auth_code, } params.update(kwargs) return paramspython url = f"{self.base_url}{endpoint}" clean_params = {k: v for k, v in params.items() if v is not None} try: if method.upper() == 'GET': response = self.session.get( url, params=clean_params, timeout=timeout ) else: response = self.session.post( url, params=clean_params, timeout=timeout )Technical Analysis
The documented API client constructs its base URL with the unencrypted
http://scheme. It then adds the username, password, and authorization code to the request parameter dictionary.For GET requests,
requestsserializes these authentication values into the URL query string. The POST branch also usesparams=clean_paramsrather than a protected request body or authorization header, so the credentials are still placed in the URL.Plaintext HTTP provides neither transport confidentiality nor server authenticity. A network-positioned attacker can inspect or modify the traffic. Credential-bearing URLs may additionally be retained by reverse proxies, server access logs, monitoring systems, and error-reporting infrastructure.
Attack Path
- A user follows the instructions in
SKILL.mdand configures a real username, password, and authorization ...[truncated 1031 chars]
- A user follows the instructions in
- Remediation
View remediation
Remediation Suggestions
- Require HTTPS for every endpoint and reject configurations that use HTTP.
- Validate TLS certificates and hostnames using the platform's standard certificate verification.
- Move authentication values out of URL parameters.
- Prefer a short-lived bearer token in the
Authorizationheader. - If a request body is required, use an HTTPS-protected POST body rather than URL parameters.
- Avoid transmitting reusable account passwords on every request.
- Introduce token expiration, rotation, revocation, and least-privilege scopes.
- Review proxy and server logs for previously exposed credentials.
- Rotate any credentials that have already been used with this implementation.
- Add automated tests that reject plaintext endpoints and verify that generated URLs never contain sensitive fields.