T09 · Insecure Skill Coding Practices
Error
- Location
SKILL.md:65- Finding
Transmission of Reusable Session Cookies and Proxy Credentials to a Third-Party Service
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md:65-76,references/api-note.md:1095-1119,references/api-note.md:2054-2077
Vulnerability Type: Sensitive credential exposure to a third-party API
Risk Level: HighVulnerable Code Snippets
SKILL.md:65-76:markdown > ⚠️ **Credential Handling** > - Some endpoints require platform session cookies. Only provide cookies if you fully trust the service provider. > - Prefer scoped OAuth/API tokens over full browser cookies. Use separate test accounts when possible. > - Rotate or revoke cookies after use. > 📋 **Data Transmission** > - All API requests are sent to `https://www.aconfig.cn`. Your credentials are transmitted to this third-party service. > - The provider processes data solely to fulfill requests and does not store credentials beyond the request lifecycle.references/api-note.md:1095-1119documents the following credential-bearing endpoint:markdown ## get_note_info_v5 `POST /api/v1/xiaohongshu/web/get_note_info_v5` <!-- Full path: /api/v1/xiaohongshu/web/get_note_info_v5 --> ### Parameters No parameters required. ### Response Standard MaxHub response: `{code, message, message_zh, data, cache_url}` ### Description - Retrieves note information using a logged-in web cookie supplied by the user. - Inputs include: - `note_id` - `xsec_token` - A logged-in web `cookie` - An authenticated proxy in the following format: http://username:password@IP:portreferences/api-note.md:2054-2077documents a signing operation that accepts a cookie:markdown ## sign `POST /api/v1/xiaohongshu/web/sign` <!-- Full path: /api/v1/xiaohongshu/web/sign --> ### Parameters No parameters required. ### Response Standard MaxHub response: `{code, message, message_zh, data, cache_url}` ### Description - Generates `X-s`, `X-t`, and `X-s-common` signature parameters. - `sign_request` co ...[truncated 3097 chars]- Remediation
View remediation
Remediation Suggestions
- Remove support for full browser session cookies from the default Skill workflow.
- Use cookie-free and public-data endpoints whenever they can satisfy the request.
- Isolate cookie-dependent features into a separate, explicitly enabled Skill with a separate permission boundary.
- Require informed, per-request user consent before transmitting any platform credential.
- Accept only narrowly scoped, short-lived tokens rather than full browser cookies.
- Reject cookies belonging to privileged or primary user accounts and recommend dedicated test accounts.
- Never place cookies, tokens, or authenticated proxy URLs in query strings, logs, error messages, telemetry, cache keys, or generated output.
- Remove support for proxy URLs containing embedded usernames and passwords. If proxy support is necessary, retrieve credentials from a dedicated secret store and prevent disclosure to the model.
- Apply strict destination allowlisting so platform credentials cannot be sent to arbitrary hosts or redirected to another origin.
- Disable redirects for credential-bearing requests or strip authorization and cookie material before following any redirect.
- Publish enforceable retention, encryption, access-control, incident-response, and deletion policies for provider-side credential handling.
- Add automated secret redaction and tests that verify sensitive values never appear in command output or logs.
- Revoke and rotate any cookies or proxy credentials previously supplied through this workflow.