T09 · Insecure Skill Coding Practices
Error
- Location
fetch_hot.py:43- Finding
Hard-Coded Weibo Session Credential Transmitted in Every API Request
- Content
View full analysis
List[Dict]: """获取热搜榜""" url = WEIBO_HOT_API try: req = urllib.request.Request(url, headers=self.headers) with urllib.request.urlopen(req, timeout=10) as response: ``` ### Technical Analysis The source code embeds a Weibo `SUB` session cookie and automatically sends it to `https://weibo.com/ajax/side/hotSearch` whenever the fetch operation runs. Session cookies are authentication credentials and must not be distributed in source code. The destination is consistent with the Skill's declared purpose, and the audit found no evidence that user-provided credentials are sent to an unrelated server. However, a bundled reusable session token is not necessary for a public hot-search fetch if an unauthenticated endpoint is available. It also means every installation shares authentication material controlled by the publisher rather than the user. Anyone who can download or inspect the Skill can extract and replay the cookie. The practical exploitability depends on whether the cookie remains valid and what server-side privileges are attached to it. ### Attack Path 1. An attacker downloads or otherwise obtains the Skill package. 2. The attacker opens `fetch_hot.py` and extracts the hard-coded `SUB` cookie. 3. The attacker places the cookie in req ...[truncated 784 chars]- Remediation
View remediation