T09 · Insecure Skill Coding Practices
Error
- Location
scripts/verify_vl.py:191- Finding
TLS Certificate Validation Disabled for Tax-Service Requests
- Content
View full analysis
dict: resp = _request( requests.get, CAPTCHA_URL, retries=REQUEST_RETRIES, verify=False, timeout=15, ) return resp.json() ``` ```python resp = _request( requests.get, QUERY_URL, retries=REQUEST_RETRIES, params=params, verify=False, timeout=60, ) ``` ### Technical Analysis The script explicitly disables TLS certificate verification for requests to the Vietnamese tax service. It also globally suppresses the warning that would normally alert operators to this unsafe behavior. HTTPS encryption without certificate validation does not authenticate the remote server. An attacker able to intercept network traffic can present an arbitrary certificate, terminate the connection, and return attacker-controlled CAPTCHA or invoice-query responses. This behavior is unnecessary for the declared functionality and exceeds the minimum acceptable network trust model. A legitimate tax-service integration should authenticate the remote service using the operating system's trusted certificate store or a specifically configured trusted CA. ### Attack Path 1. A user runs the invoice-verification Skill over an attacker-controlled or compromised network. 2. The attacker intercepts traffic directed to the tax-service host. 3. The attacker presents an untrusted TLS certificate. 4. Because `verify=False` is set, the script accepts the certificate without warning. 5. The attacker returns a fabricated CAPTCHA response or invoice-query response. 6. The script parses the fabricated JSON and may report an altered invoice-authenticity result. ### Impact Assessment ...[truncated 624 chars]- Remediation
View remediation