T09 · Insecure Skill Coding Practices
Error
- Location
- SKILL.md:15
- Finding
- Bearer API Token Transmitted over Unencrypted HTTP## Vulnerability Details **File Location**: `SKILL.md:15-27` **Additional Affected Call Sites**: `SKILL.md:35-39`, `SKILL.md:50-58`, `references/workflow.md:8`, `references/workflow.md:14`, `references/workflow.md:29` **Vulnerability Type**: Plaintext transmission of sensitive credentials **Risk Level**: High ### Vulnerable Code ```markdown - `RAGTOP_API_URL`: RAGTOP API base URL. Defaults to `http://10.71.10.71:9380` if not set. - `RAGTOP_API_TOKEN`: Your RAGTOP API access token. Can be configured via the OpenClaw Web UI. ## 1. 核心工具构建指南 (How to build curl) 在调用以下接口前，请确保已获取环境变量 `${RAGTOP_API_URL}` 和 `${RAGTOP_API_TOKEN}`。如果 `${RAGTOP_API_URL}` 为空，请使用默认值 `http://10.71.10.71:9380`。 ### A. 列出知识库 (list_kb) 用于获取所有可用的 `knowledge_id`。 ```bash curl -L -X POST "${RAGTOP_API_URL}/api/v1/ragtop/tool/list_kb" \ -H "Authorization: Bearer ${RAGTOP_API_TOKEN}" \ -H "Content-Type: application/json" ``` ``` The workflow repeats the same authenticated request pattern: ```markdown - **动作**: 调用 `curl -X POST "${RAGTOP_API_URL}/api/v1/ragtop/tool/list_kb" -H "Authorization: Bearer ${RAGTOP_API_TOKEN}"`。 ``` ### Technical Analysis The Skill defaults `RAGTOP_API_URL` to an `http://` endpoint and instructs the agent to send `RAGTOP_API_TOKEN` through the HTTP `Authorization` header. HTTP does not provide transport encryption, endpoint authentication, or message integrity. Consequently, the bearer token, user-derived search queries, document identifiers, retrieved knowledge-base content, and API responses can be observed or modified by an attacker with a suitable network position. Because a bearer token grants access to whoever possesses it, interception is sufficient for impersonation; no additional secret is required. The issue affects all documented API operations that inherit the default URL, including knowledge-base enumeration, document enumeration, and semantic retrieval. ### Attack Path 1. `RAGTOP_AP ...[truncated 1559 chars]
- Remediation
- ## Remediation Suggestions 1. Replace the HTTP default with an HTTPS endpoint: ```markdown Defaults to `https://ragtop.example.internal:9380` if not set. ``` 2. Reject any configured URL whose scheme is not `https`, rather than silently accepting or falling back to plaintext HTTP. 3. Preserve TLS certificate verification in `curl`; do not add `-k` or `--insecure`. 4. Deploy a certificate whose identity matches the configured RAGTOP hostname and whose issuing authority is trusted by the execution environment. 5. If a private certificate authority is required, configure its CA bundle explicitly instead of disabling verification. 6. Use narrowly scoped, short-lived API tokens with only the permissions needed for listing and retrieval operations. 7. Rotate or revoke tokens that may previously have been transmitted through the documented HTTP endpoint. 8. Avoid logging command traces, expanded environment variables, or Authorization headers. 9. Consider adding connection timeouts and restricting redirects, because `curl -L` can follow redirects; ensure credentials are never forwarded to an untrusted destination. 10. Update both `SKILL.md` and `references/workflow.md` so every example explicitly requires secure transport.