T09 · Insecure Skill Coding Practices
Error
- Location
scripts/bolt.sh:29- Finding
API token and project data can be transmitted over untrusted or plaintext HTTP endpoints
- Content
View full analysis
/dev/null || uuidgen 2>/dev/null || date +%s%N) curl -sf -X POST \ -H "Content-Type: application/json" \ -H "Idempotency-Key: $idem_key" \ "${AUTH_ARGS[@]}" \ -d "$body" \ "$BASE$path" } # Wrapper: PATCH request with JSON body bolt_patch() { local path="$1" local body="$2" local idem_key idem_key=$(cat /proc/sys/kernel/random/uuid 2>/dev/null || uuidgen 2>/dev/null || date +%s%N) curl -sf -X PATCH \ -H "Content-Type: application/json" \ -H "Idempotency-Key: $idem_key" \ "${AUTH_ARGS[@]}" \ -d "$body" \ "$BASE$path" } ``` The documentation explicitly recommends plaintext examples: ```bash export BOLT_BASE_URL="http://localhost:4000" export BOLT_API_TOKEN="your-token-here" ``` ### Technical Analysis `BOLT_BASE_URL` is accepted without parsing or validating its scheme, hostname, or trust boundary. When `BOLT_API_TOKEN` is present, the script forwards it in the `x-bolt-token` header to every constructed destination. Request bodies can additionally contain project details, story descriptions, notes, assignee identities, and agent activity. Network communication is necessary for the declared Bolt management functio ...[truncated 1544 chars]- Remediation
View remediation