T09 · Insecure Skill Coding Practices
Error
- Location
- read_wechat_article.py:83
- Finding
- TLS Certificate Verification Disabled for Article Retrieval## Vulnerability Details **File Location**: `read_wechat_article.py`, lines 83-89 **Vulnerability Type**: Improper certificate validation **Risk Level**: High ### Vulnerable Code ```python response = session.get( cleaned_url, timeout=TIMEOUT, allow_redirects=True, verify=False # Disable SSL verification to address issues in some environments ) ``` ### Technical Analysis The article-fetching request explicitly sets `verify=False`, disabling TLS certificate validation for every outbound request made through this code path. As a result, the client does not verify that the remote certificate is valid or belongs to the intended WeChat domain. Because `allow_redirects=True` is also enabled, the request may follow redirects while retaining the same lack of certificate validation. The implementation does not validate the scheme and hostname of the final response URL. An attacker with a network-level interception capability—such as control over a hostile Wi-Fi access point, compromised proxy, manipulated local network, or similar man-in-the-middle position—could impersonate the destination and provide arbitrary HTML. The forged response would then be parsed as a genuine article. ### Attack Path 1. A user invokes the Skill with a syntactically valid `https://mp.weixin.qq.com/s/...` URL. 2. The Skill validates only the initial URL prefix and calls `fetch_wechat_html`. 3. The attacker intercepts the HTTPS connection or manipulates its redirect path. 4. The attacker presents an invalid or attacker-controlled TLS certificate. 5. The client accepts the certificate because `verify=False`. 6. The attacker returns forged article HTML containing manipulated text, metadata, links, or image URLs. 7. The Skill parses the response and returns the attacker-controlled material as trusted article data. 8. If a downstream AI Agent interprets retrieved article text as instructions rather than untrusted content, the forged content could also facilitate indirect pro ...[truncated 841 chars]
- Remediation
- ## Remediation Suggestions 1. Restore certificate verification by removing the `verify` argument or setting it explicitly to `True`: ```python response = session.get( cleaned_url, timeout=TIMEOUT, allow_redirects=False ) ``` 2. Validate redirects manually before following them. Require: - The `https` scheme. - The exact hostname `mp.weixin.qq.com`. - An expected article path beginning with `/s/`. - A bounded number of redirects. 3. Do not introduce an insecure fallback that retries with certificate verification disabled. If validation fails, return an explicit network or certificate error. 4. Use the operating system or `certifi` CA trust store. If a controlled enterprise environment requires a private CA, allow an explicitly configured CA bundle rather than disabling verification globally. 5. Add tests that mock: - Certificate validation failures. - Redirects to unexpected hosts. - Redirects to non-HTTPS URLs. - Excessive redirect chains. 6. Treat fetched article text as untrusted data in downstream Agent workflows. Keep it clearly separated from system or developer instructions and do not execute commands or follow instructions embedded in article content.