T09 · Insecure Skill Coding Practices
Warning
- Location
- SKILL.md:24
- Finding
- Bearer API Credentials May Be Transmitted Over Cleartext HTTP<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 24-28 and 49-61 **Vulnerability Type**: Cleartext transmission of bearer credentials **Risk Level**: Medium ### Vulnerable Code Snippet ```markdown The POLT API base URL is: \`\`\` POLT_API_URL=http://localhost:3000 \`\`\` Replace `localhost:3000` with the actual POLT server address if it's hosted elsewhere. All endpoints below are relative to this base URL. ``` ```markdown **Response:** \`\`\`json { "agent_id": "uuid-string", "api_key": "polt_abc123..." } \`\`\` Save your `api_key` securely. You need it for all authenticated requests. It cannot be retrieved again. ### Step 2: Authenticate For all authenticated endpoints, include your API key in the Authorization header: \`\`\` Authorization: Bearer polt_abc123... \`\`\` ``` ### Technical Analysis The Skill defines the API base URL with the unencrypted `http://` scheme and directs users to replace `localhost:3000` with an externally hosted server address. It does not instruct users to change the scheme to HTTPS or prohibit cleartext authentication to non-loopback destinations. The API key is a bearer credential: possession of the value is sufficient to authenticate as the corresponding agent. If the documented configuration is adapted to a remote server while retaining HTTP, registration responses and subsequent `Authorization` headers can traverse the network without confidentiality or integrity protection. An attacker with a suitable network position—such as control of an untrusted Wi-Fi access point, compromised router, malicious proxy, or access to another relevant network segment—could observe the API key or alter API traffic. This issue does not imply that loopback-only HTTP is inherently remotely exposed; exploitation requires use of HTTP with a remote endpoint and an attacker capable of intercepting that traffic. ### Attack Path 1. A user replaces `localhost:3000` with a remote POLT server address as instructed b ...[truncated 1259 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Use HTTPS for every non-loopback deployment: ```text POLT_API_URL=https://polt.example.com ``` 2. Explicitly state that plain HTTP is permitted only for loopback development endpoints such as `127.0.0.1` or `localhost`. 3. Add configuration validation that rejects `http://` URLs unless the resolved destination is an approved loopback address. 4. Require standard TLS certificate and hostname validation. Do not recommend disabling certificate verification as a workaround. 5. Avoid placing realistic token-like values in examples. Use an unmistakable placeholder: ```text Authorization: Bearer <POLT_API_KEY> ``` 6. Provide a credential revocation and rotation mechanism, and instruct users to rotate keys immediately after suspected exposure. 7. Recommend storing the API key in a protected secret store or environment variable rather than source files, logs, shell history, or other plaintext configuration. 8. Ensure clients redact `Authorization` headers and registration responses from diagnostic logs. ]]>