T09 · Insecure Skill Coding Practices
Error
- Location
- env-example.txt:2
- Finding
- Gitea Access Token and Meeting Data Transmitted over Plaintext HTTP<![CDATA[ ## Vulnerability Details **File Location**: `env-example.txt:2`; `scripts/gitea_utils.py:9-15`; `scripts/log_utils.py:14-24` **Vulnerability Type**: Cleartext transmission of credentials and sensitive data **Risk Level**: High ### Vulnerable Code ```text # env-example.txt:1-3 # Gitea GITEA_BASE_URL=http://43.156.243.152:3000 GITEA_TOKEN_BOT=your_aifusionbot_access_token_here ``` ```python # scripts/gitea_utils.py:9-17 def gitea_request(method, path, token, base_url, raise_on_error=True, **kwargs): url = f"{base_url.rstrip('/')}/api/v1{path}" headers = { "Authorization": f"token {token}", "Content-Type": "application/json", } resp = requests.request(method, url, headers=headers, timeout=15, **kwargs) if raise_on_error: resp.raise_for_status() return resp ``` ```python # scripts/log_utils.py:14-24 api_url = f"{base_url.rstrip('/')}/api/v1/repos/{owner}/{repo_name}/contents/{filepath}" headers = { "Authorization": f"token {token}", "Content-Type": "application/json", } existing_content = "" existing_sha = None resp = requests.get(api_url, headers=headers, timeout=10) ``` ### Technical Analysis The distributed example configures Gitea through a raw IP address using plain HTTP. The request helpers then place the bot's bearer token in the `Authorization` header and transmit it to that URL without enforcing TLS. The same connection carries meeting metadata, participant information, repository content, and repository modifications. Base64 encoding used by the Gitea contents API is only a transport representation and provides no confidentiality or integrity. An attacker capable of observing or modifying traffic between the Skill host and Gitea can capture the reusable access token. An active network attacker can also tamper with API responses, causing the Skill to process falsified repository state. ### Attack Path 1. An operator copies `env-example.txt` to the documented `.env` location without ...[truncated 1166 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Replace the example URL with an HTTPS endpoint using a trusted DNS name. 2. Reject insecure URLs in code before making requests: ```python from urllib.parse import urlparse parsed = urlparse(base_url) if parsed.scheme != "https": raise ValueError("GITEA_BASE_URL must use HTTPS") ``` 3. Do not disable TLS certificate validation. Use a private certificate authority bundle if the Gitea service uses an internal CA. 4. Rotate any token that may already have been transmitted over HTTP. 5. Create a dedicated, narrowly scoped bot token limited to the repositories and content operations required by this Skill. 6. Where Gitea supports it, apply source-IP restrictions, expiration, and repository-specific permissions. 7. Avoid placing a production-looking public IP in the distributed configuration example. ]]>