T09 · Insecure Skill Coding Practices
- Location
SKILL.md:24- Finding
Paid Bearer Token Transmitted over Unencrypted HTTP
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md:24-34;README.md:1-12
Vulnerability Type: Cleartext transmission of authentication credentials
Risk Level: HighThe skill instructs users to configure a reusable, paid bearer token as an authorization header for an MCP endpoint that uses plaintext HTTP.
Vulnerable Code
SKILL.md:24-34:json { "mcpServers": { "ip-data": { "type": "http", "url": "http://39.108.187.200:5210/yc_data/get_ip_data", "headers": { "Authorization": "Bearer sk-[user-provided-token]" } } } }The token placeholder above has been normalized into English; the source instructs the user to substitute the token they provided.
README.md:1-12:json { "mcpServers": { "ip-data": { "type": "http", "url": "http://39.108.187.200:5210/yc_data/get_ip_data", "headers": { "Authorization": "Bearer sk-token" } } } }Technical Analysis
HTTP does not provide transport confidentiality, server authenticity, or message integrity. Every request to this endpoint includes a reusable bearer credential in the
Authorizationheader. An attacker in a suitable network position can inspect the request, recover the token, observe queried IP names, or modify MCP requests and responses.The use of a raw IP address also prevents the normal domain-based identity model expected for a properly authenticated HTTPS service. Because bearer tokens authorize their holder without an additional proof-of-possession mechanism, an intercepted token can generally be replayed directly.
The skill additionally asks the user to provide the token during the conversation before constructing the configuration. This unnecessarily exposes the credential to conversation history, logs, Agent context, and any systems processing the interaction.
Attack Path
- A user supplies a vali ...[truncated 1323 chars]
- Remediation
View remediation
Remediation Suggestions
- Replace the plaintext endpoint with an authenticated HTTPS endpoint hosted on a controlled domain.
- Configure a valid certificate chain and enforce certificate and hostname validation on every client.
- Disable or redirect plaintext HTTP at the server, and ensure credentials are never sent before a secure TLS connection is established.
- Do not ask users to disclose tokens in conversation. Instruct them to enter credentials directly through a secret manager, protected credential prompt, or environment-variable reference.
- Avoid storing raw credentials in broadly readable configuration files. If configuration storage is unavoidable, require restrictive file permissions and document the protection requirements.
- Use narrowly scoped, short-lived, revocable tokens where supported. Add token rotation, usage limits, anomaly detection, and revocation guidance.
- Update both
SKILL.mdandREADME.mdso they cannot direct users back to the insecure HTTP endpoint. - Rotate any token that has already been used with the documented plaintext endpoint because its confidentiality cannot be assured.