T09 · Insecure Skill Coding Practices
Error
- Location
- scripts/common.py:403
- Finding
- Sensitive API credentials, audio, transcripts, and biometric data may be transmitted over plaintext HTTP## Vulnerability Details **File Location**: `scripts/common.py:403-419`; insecure HTTP use is documented in `SKILL.md:71-81, 104-106` and `references/configuration.md:20-21, 82-83` **Vulnerability Type**: Plaintext transmission of sensitive information **Risk Level**: High ### Vulnerable Code ```python resolved_url = url or os.environ.get("VOSCRIPT_URL") resolved_key = api_key or os.environ.get("VOSCRIPT_API_KEY") if not resolved_url: raise ValueError(t("url_empty")) if not resolved_key: raise ValueError(t("key_empty")) self.url = resolved_url.rstrip("/") self.api_key = resolved_key self.timeout = timeout self._session = requests.Session() self._session.headers.update( { "X-API-Key": self.api_key, "Accept": "application/json", } ) ``` The documentation explicitly permits plaintext HTTP: ```text - VOSCRIPT_URL: Service address, for example http://localhost:7880 - Local deployment: http://localhost:7880 - LAN deployment: http://<nas-ip>:7880 or a custom domain ``` It also recommends HTTP as a fallback for certificate problems: ```text For self-signed certificate issues, contact the deployment administrator for a trusted certificate or use HTTP instead. ``` The documented upload sends both the credential and audio over the configured transport: ```bash curl -X POST "$VOSCRIPT_URL/api/transcribe" \ -H "X-API-Key: $VOSCRIPT_API_KEY" \ -F "file=@/path/to/audio.wav" ``` ### Technical Analysis `VoScriptClient` accepts either HTTP or HTTPS and unconditionally attaches the static API key to its session. It does not reject or require explicit confirmation for plaintext HTTP on non-loopback hosts. This behavior is especially sensitive because the client handles: - Static API credentials. - User-selected audio recordings. - Full transcript text and original filenames. - Speaker names and mappings. - Persistent biometric voicepr ...[truncated 2123 chars]
- Remediation
- ## Remediation Suggestions 1. Require HTTPS whenever the destination is not a loopback address. 2. Permit plaintext HTTP only for `localhost`, `127.0.0.1`, and `::1`, or behind an explicit high-friction option such as `--allow-insecure-http`. 3. Validate the parsed URL during client initialization and reject unsupported schemes, missing hostnames, embedded credentials, and non-loopback HTTP destinations. 4. Remove the documentation recommendation to use HTTP when certificates fail. 5. Support a configurable trusted CA bundle for private or self-signed deployments, while retaining certificate verification. 6. Document secure reverse-proxy deployment with TLS and appropriate network access controls. 7. Prefer short-lived, endpoint-scoped credentials over a static key with broad read, write, and delete capabilities. 8. Rotate any API key that may already have been used over an untrusted plaintext connection.