T09 · Insecure Skill Coding Practices
- Location
PLAYBOOK.md:6- Finding
Authentication Token Exposed Through URL Query Parameter
- Content
View full analysis
Vulnerability Details
File Location:
PLAYBOOK.md, lines 6–10
Vulnerability Type: Authentication token exposure through a URL
Risk Level: MediumVulnerable code snippet:
markdown ## Pre-flight (every tick) 1. Ensure logged in: open `MagicHaqi.html?token=<TOKEN>&agent=haqi-operator`, check `getState().loggedIn === true`. 2. Load ops memory: read `agent/ops-state.json` (create with zeros if missing). 3. Read recent `agent/audit.log` (last ~30 lines) and current `getState()`.Technical Analysis
The playbook instructs the operator to place an authentication token in the
tokenURL query parameter. Although the documented value is a placeholder rather than a hardcoded credential, following this instruction with a real token can expose that credential through browser history, copied URLs, screenshots, diagnostic data, reverse-proxy or web-server access logs, and monitoring systems that record complete URLs.Query parameters can also be propagated in referrer information when the page loads or navigates to another resource, depending on the application's
Referrer-Policy, browser behavior, and destination. Any party with access to one of these disclosure channels could recover the token. Whether the token can then be replayed is dependent on authentication behavior in the MagicHaqi application, which is outside the audited project.Attack Path
- The operator replaces the documented
<TOKEN>placeholder with a valid authentication token. - The operator opens the resulting URL in a browser as instructed.
- The complete URL is retained by browser history or recorded by infrastructure, telemetry, screenshots, or logs.
- An attacker with access to one of those records obtains the query-string token.
- If the application accepts bearer-token replay, the attacker submits the exposed token to impersonate the associated operator until the token expires or is revoked.
...[truncated 418 chars]
- The operator replaces the documented
- Remediation
View remediation
Remediation Suggestions
- Do not transmit authentication credentials in URL query parameters.
- Establish the authenticated session using a secure mechanism such as an
Authorizationheader or aSecure,HttpOnly, and appropriately configuredSameSitecookie. - Change the playbook to direct the operator to the URL without a token, for example
MagicHaqi.html?agent=haqi-operator, after authentication has been completed through the approved login flow. - Apply a restrictive
Referrer-Policy, such asno-referrer, as defense in depth; this does not make query-string credentials safe. - Configure servers, proxies, analytics tools, and error-reporting systems to redact sensitive parameters from existing records.
- Rotate any real tokens previously passed in URLs, use short-lived scoped credentials, and reject token replay where possible.
- Add automated checks that flag credential-like query parameters in skill instructions and configuration.