T09 · Insecure Skill Coding Practices
Warning
- Location
- SKILL.md:16
- Finding
- Queue Secret May Be Transmitted over Plaintext HTTP<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 16-18, 48-51, and 106-108 **Vulnerability Type**: Plaintext transmission of authentication credentials **Risk Level**: Medium ### Vulnerable Code ```markdown - `THREADS_FASTAPI_BASE_URL` (example: `http://127.0.0.1:8000`) - `THREADS_QUEUE_SECRET` (the value to send as `X-Queue-Secret`, only for `/threads/publish`) - Optional: `THREADS_TENANT_ID` (default: `agency_paris`) ``` ```markdown - URL: `{BASE}/api/v1/threads/publish` - Method: `POST` - Headers: `X-Queue-Secret: <THREADS_QUEUE_SECRET>` - Body: JSON payload (see below) ``` ```markdown ## Safety - Never forward secrets from chat into shell commands except as the `-QueueSecret` argument. - Do not log the secret. - Validate that `BaseUrl` is an http(s) URL. ``` ### Technical Analysis The skill permits any syntactically valid HTTP or HTTPS base URL while directing the agent to transmit `THREADS_QUEUE_SECRET` in the `X-Queue-Secret` request header. The documented HTTP example uses a loopback address, where plaintext HTTP may be acceptable, but the validation requirement does not restrict HTTP to loopback destinations. If a remote `http://` URL is configured, the authentication secret, post content, and associated metadata are transmitted without transport encryption. A network-positioned attacker could inspect or modify this traffic. The skill also does not specify redirect validation, so an initially trusted endpoint could potentially redirect a request to an insecure or unintended destination, depending on HTTP tool behavior. ### Attack Path 1. An attacker influences the gateway configuration, configuration guidance, DNS/network path, or user choice so that `THREADS_FASTAPI_BASE_URL` points to a remote plaintext HTTP endpoint. 2. A user asks the agent to queue or publish a Threads post. 3. The agent sends a request to `/api/v1/threads/publish` with `THREADS_QUEUE_SECRET` in the `X-Queue-Secret` header. 4. A network-positioned at ...[truncated 690 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions - Require HTTPS for every non-loopback backend URL. - Permit plaintext HTTP only when the resolved destination is strictly `127.0.0.1`, `::1`, or an explicitly approved local endpoint. - Reject URLs containing embedded credentials, ambiguous host representations, or unsupported schemes. - Validate the destination again after DNS resolution to reduce hostname-based bypasses. - Disable automatic redirects for authenticated requests, or validate every redirect target before forwarding the secret. - Maintain an explicit allowlist of approved backend origins where operationally possible. - Use a narrowly scoped, revocable credential and rotate it immediately if plaintext transmission may have occurred. - Update the safety guidance to state that `X-Queue-Secret` must never be transmitted over remote plaintext HTTP. ]]>