T09 · Insecure Skill Coding Practices
Warning
- Location
- SKILL.md:80
- Finding
- API Credentials and Search Queries May Be Transmitted over Plaintext HTTP## Vulnerability Details **File Location**: `SKILL.md:36-38` and `SKILL.md:80-84` **Vulnerability Type**: Plaintext transmission of sensitive information **Risk Level**: Medium The documented configuration explicitly permits an unencrypted HTTP base URL: ```text After deployment, note your: - **Base URL** (e.g., `https://search.example.com` or `http://192.168.1.50:8080`) - **API key** (configured during setup) ``` Requests then transmit the API key in a header and the search query in the request body: ```bash curl -s -X POST "$BASE_URL/search" \ -H "X-API-KEY: $API_KEY" \ -H "Content-Type: application/json" \ -d '{"q": "search query", "num": 10}' | jq . ``` ### Technical Analysis The skill does not require the configured `BASE_URL` to use HTTPS. When a user follows the documented HTTP example, TLS provides neither confidentiality nor integrity for requests or responses. The `X-API-KEY` header and JSON request body are therefore visible to any party able to observe traffic between the OpenClaw host and the search server. A network-positioned attacker can also alter requests or responses in transit because the client has no authenticated encrypted channel to the server. ### Attack Path 1. A user configures `BASE_URL` with the documented `http://` scheme. 2. The skill loads the API key from `~/.openclaw/workspace/.serper-clone-api-key`. 3. The skill submits a search request containing the key in `X-API-KEY` and the user's query in the JSON body. 4. An attacker with access to the relevant network path, such as a shared wireless network, local network segment, proxy, or container overlay, captures the plaintext request. 5. The attacker recovers the API key and private search terms. 6. The attacker may reuse the key against the configured service or modify returned search results before they reach the agent. ### Impact Assessment Successful exploitation can disclose the configured Serper Clone AP ...[truncated 550 chars]
- Remediation
- ## Remediation Suggestions - Require `BASE_URL` to use the `https://` scheme and reject unsupported or insecure schemes before sending credentials. - Remove the general-purpose `http://192.168.1.50:8080` example from the documentation. - If plaintext HTTP is operationally necessary for local development, restrict it explicitly to loopback addresses such as `127.0.0.1` or `::1` and document that it must not be used across a network. - Preserve certificate and hostname verification in `curl`; do not recommend options such as `--insecure`. - Recommend a private certificate authority or a reverse proxy with TLS for self-hosted deployments. - Use narrowly scoped, revocable API keys and rotate any key suspected of having traversed an untrusted plaintext connection. - Clearly warn that both credentials and search queries are sensitive and must only be sent through an authenticated encrypted channel.