T09 · Insecure Skill Coding Practices
Error
- Location
- SKILL.md:142
- Finding
- Bearer API Credentials Transmitted over Plaintext HTTP## Vulnerability Details **File Location**: `SKILL.md:142-143` **Additional Locations**: `SKILL.md:16`, `SKILL.md:182-183`, `SKILL.md:269-270`, `SKILL.md:307-308`, `SKILL.md:360-361`, `SKILL.md:400-401` **Vulnerability Type**: Cleartext transmission of sensitive credentials **Risk Level**: High ### Vulnerable Code ```bash curl "http://ipaynapi.gpuart.cn/user/me" \ -H "Authorization: Bearer YOUR_API_KEY" ``` The same plaintext HTTP pattern is documented for `/user/my-keys`: ```bash curl "http://ipaynapi.gpuart.cn/user/my-keys" \ -H "Authorization: Bearer YOUR_API_KEY" ``` ### Technical Analysis The Skill instructs users to transmit a bearer API key to `ipaynapi.gpuart.cn` over unencrypted HTTP. Bearer credentials grant access based solely on possession, so transport-layer confidentiality and integrity are mandatory. HTTP provides neither property. Network intermediaries can observe the `Authorization` header or modify the server response. The endpoints are especially sensitive because `/user/me` and `/user/my-keys` return account information, wallet metadata, transaction details, and active API keys. This behavior is not required for the declared account-management functionality. The same requests should be made exclusively over authenticated HTTPS. ### Attack Path 1. A user follows the Skill documentation and calls an account endpoint using `http://ipaynapi.gpuart.cn`. 2. The request traverses an untrusted network, proxy, gateway, Wi-Fi access point, or other intermediary. 3. An attacker captures the plaintext `Authorization: Bearer ...` header. 4. The attacker replays the stolen bearer credential against the user-management service. 5. Subject to the credential's server-side privileges, the attacker retrieves account details, wallet metadata, usage information, transaction history, or API-key records. 6. A man-in-the-middle attacker may also modify plaintext responses presented to the user. ## ...[truncated 459 chars]
- Remediation
- ## Remediation Suggestions 1. Replace every `http://ipaynapi.gpuart.cn` URL with an authenticated `https://` endpoint. 2. Configure the server to reject plaintext HTTP rather than silently serving authenticated endpoints over it. 3. Redirecting HTTP to HTTPS is not sufficient for requests already carrying credentials; clients must originate authenticated requests over HTTPS. 4. Enable HSTS with an appropriate policy after confirming complete HTTPS support. 5. Validate certificates and hostnames using standard TLS verification. Do not add certificate-verification bypasses. 6. Rotate any API key that may previously have been transmitted over plaintext HTTP. 7. Minimize endpoint responses so that one API key cannot unnecessarily retrieve other complete API-key values. 8. Consider short-lived, scoped access tokens instead of long-lived bearer API keys for account-management operations.