T09 · Insecure Skill Coding Practices
Error
- Location
- env-example.txt:2
- Finding
- Gitea Bot Token Transmitted over Plaintext HTTP<![CDATA[ ## Vulnerability Details **File Location**: `env-example.txt:2`, `scripts/gitea_utils.py:9-15`, `scripts/log_utils.py:13-18` **Vulnerability Type**: Cleartext transmission of credentials **Risk Level**: High ### Vulnerable Code ```text # env-example.txt GITEA_BASE_URL=http://43.156.243.152:3000 ``` ```python # scripts/gitea_utils.py def gitea_request(method, path, token, base_url, raise_on_error=True, **kwargs): url = f"{base_url.rstrip('/')}/api/v1{path}" headers = { "Authorization": f"token {token}", "Content-Type": "application/json", } resp = requests.request(method, url, headers=headers, timeout=15, **kwargs) ``` ```python # scripts/log_utils.py api_url = f"{base_url.rstrip('/')}/api/v1/repos/{owner}/{repo_name}/contents/{filepath}" headers = { "Authorization": f"token {token}", "Content-Type": "application/json", } existing_content = "" existing_sha = None resp = requests.get(api_url, headers=headers, timeout=10) ``` ### Technical Analysis The example configuration directs all Gitea API traffic to a public IP address using unencrypted HTTP. The API helpers place the Gitea bot token in the `Authorization` header for every request. HTTP provides neither transport confidentiality nor server authentication. A network adversary can observe the token, alter API responses, or redirect workflow operations. Base64 encoding used by the Gitea Contents API does not provide encryption and does not mitigate this exposure. Access to a local credential file is necessary for the declared Gitea integration. The vulnerability is not the file access itself, but transmitting the loaded credential over an insecure transport. ### Attack Path 1. A user copies the provided example configuration and supplies a valid bot token. 2. The Skill invokes `check`, `create-issues`, or `finish`. 3. The API helper sends `Authorization: token <GITEA_TOKEN_BOT>` over plaintext HTTP. 4. An attacker with network visibility captures the ...[truncated 574 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions - Replace the default URL with an HTTPS endpoint backed by a valid certificate. - Reject `http://` Gitea URLs at startup rather than silently accepting them. - Validate the destination hostname against an administrator-configured allowlist. - Use a dedicated, narrowly scoped bot token with access only to required repositories and operations. - Rotate the existing token if it has ever been used with the plaintext endpoint. - Consider certificate pinning or an internal trusted CA where the deployment environment requires stronger endpoint assurance. ]]>