T09 · Insecure Skill Coding Practices
Error
- Location
scripts/archery_query.py:19- Finding
Plaintext HTTP Defaults Expose Credentials, Session Cookies, SQL, and Query Results
- Content
View full analysis
None: parser.add_argument( "--base-url", default="http://your-archery-server:9123", help="Archery base URL", ) ``` From `scripts/archery_mcp_server.py`: ```python def build_client() -> ArcheryClient: client = ArcheryClient( base_url=os.getenv("ARCHERY_BASE_URL", "http://your-archery-server:9123"), timeout=int(os.getenv("ARCHERY_TIMEOUT", "15")), verify=not env_bool("ARCHERY_INSECURE", False), session_file=os.getenv("ARCHERY_SESSION_FILE", "~/.archery/cache/session.json"), ) ``` The configuration documentation also recommends a plaintext endpoint: ```json { "archery_username": "your_username", "archery_password": "your_password", "archery_base_url": "http://your-server:9123" } ``` ### Technical Analysis The Skill defaults to and documents unencrypted HTTP for communication with the Archery server. The HTTP client transmits authentication credentials to `/authenticate/`, sends authenticated session cookies in later requests, submits SQL statements, and receives database query results. TLS certificate verification does not protect an `http://` connection. Consequently, any actor able to observe or alter traffic between the client and Archery can read or modify sensitive data. The documentation makes insecure deployment more likely because users may copy the provided configuration directly. ### Attack Path 1. A user follows t ...[truncated 1024 chars]- Remediation
View remediation