T09 · Insecure Skill Coding Practices
Error
- Location
- SKILL.md:18
- Finding
- API Credentials May Be Transmitted Over Plaintext HTTP to a Configurable Remote Host## Vulnerability Details **File Location**: `SKILL.md:18-19` **Vulnerability Type**: Plaintext transmission of sensitive authentication credentials **Risk Level**: High ### Vulnerable Code Snippet ```markdown - **Base URL:** Use env `TMS_API_URL` if set; otherwise, when TMS and OpenClaw run on the **same host**, use **`http://127.0.0.1:8080`** (TMS default API listen). Do not add a trailing slash. All endpoint paths in the spec use the prefix `/api/v1` — e.g. `GET /health` means **`GET {BaseURL}/api/v1/health`**. - **Authentication:** If env `TMS_API_KEY` is configured, always send every API request with `Authorization: Bearer <TMS_API_KEY>` or header `X-API-Key: <TMS_API_KEY>`. If a request returns 401, retry once with the configured `TMS_API_KEY`; do not ask the user to reveal the key. Only omit auth when `TMS_API_KEY` is truly absent and TMS is explicitly configured to allow unauthenticated localhost requests. ``` The associated remote-host configuration example in `README.md:40-41` explicitly permits plaintext HTTP: ```markdown - `TMS_API_URL` — **optional.** Base URL of TMS API. When not set and agent runs on the same host as TMS, default is `http://127.0.0.1:8080`. Set when TMS is on another host (e.g. `http://tms-host:8080`). - `TMS_API_KEY` — **required when TMS has API auth enabled.** Ansible-generated installs set it by default. Configure it in OpenClaw skill env or `skills.entries.tms.apiKey`; the agent should not ask the user to paste it into chat. ``` `README.md:103` also demonstrates sending the credential to the configured URL without requiring HTTPS: ```markdown - **"API unreachable" / connection errors** — Check `TMS_API_URL` (no trailing slash), firewall, and that TMS is running with API enabled. Test: `curl "$TMS_API_URL/api/v1/health"` (from same host) or with key: `curl -H "Authorization: Bearer $TMS_API_KEY" "$TMS_API_URL/api/v1/health"`. ``` ### Technical Analysis The Skill allows `TMS_API_URL` ...[truncated 2525 chars]
- Remediation
- ## Remediation Suggestions 1. Require `https://` for every non-loopback `TMS_API_URL`. 2. Permit plaintext HTTP only when the destination is a verified loopback address such as `127.0.0.1`, `[::1]`, or a strictly validated equivalent. 3. Refuse to attach `TMS_API_KEY` when the URL uses plaintext HTTP and is not loopback. 4. Replace the remote example `http://tms-host:8080` with an HTTPS URL. 5. Document secure deployment through TLS termination, a trusted reverse proxy, VPN, or mutually authenticated TLS. 6. Require normal certificate and hostname validation; do not recommend disabling TLS verification. 7. Do not forward authentication headers across redirects to another origin. Prefer disabling redirects for authenticated API calls unless the destination is explicitly validated. 8. Validate the configured URL scheme and destination before the first request, including after DNS resolution where feasible. 9. Use a dedicated, rotatable TMS key with the narrowest available permissions. If supported by TMS, separate read-only and destructive-operation credentials. 10. Rotate `TMS_API_KEY` immediately if it may previously have been sent over an untrusted plaintext network. 11. Update the troubleshooting command to reject or warn about authenticated plaintext remote URLs.