T09 · Insecure Skill Coding Practices
Error
- Location
- SKILL.md:29
- Finding
- OA Tokens and Plaintext Messages Transmitted Over Insecure Transport## Vulnerability Details **File Location**: `SKILL.md:29`, `SKILL.md:47-49`, `SKILL.md:80-83`, `references/im-api.md:109-111`, `references/im-api.md:504-507` **Vulnerability Type**: Insecure transport and ineffective message confidentiality **Risk Level**: High ### Vulnerable Code `SKILL.md:29`: ```text WebSocket URL: ws://{EOFFICE_IM_BASE_URL}/ ``` `SKILL.md:47-49`: ```javascript const socket = io('http://localhost:3000', { auth: { token: 'your-token-here' ``` `SKILL.md:80-83`: ```javascript message_content: 'AES-encrypted message content', text_message_content: 'Plaintext message content', ``` `references/im-api.md:109-111`: ```javascript const socket = io('http://localhost:3000', { auth: { token: 'YOUR_OA_TOKEN' ``` `references/im-api.md:504-507`: ```javascript message_content: encrypt(content, key, iv), text_message_content: content, message_type: 1, sender: 'current_user', ``` ### Technical Analysis The Skill explicitly documents unencrypted `ws://` and `http://` connections while placing an OA access token in the Socket.IO authentication handshake. HTTP and plaintext WebSocket traffic do not provide transport confidentiality or integrity. If these examples are used on an untrusted network, a network-positioned attacker can observe or manipulate the handshake and subsequent events. The documented message format also transmits the same content twice: once as AES ciphertext in `message_content` and again as plaintext in `text_message_content`. Consequently, encrypting `message_content` does not protect message confidentiality. Intermediaries, the IM service, server-side logs, monitoring systems, and any component able to inspect the event payload can access the plaintext field. This issue is particularly significant because the token grants access to an API that supports private messaging, group messaging, group membership changes, message deletion or withdrawal ...[truncated 1969 chars]
- Remediation
- ## Remediation Suggestions 1. Require `https://` and `wss://` for every non-local deployment. 2. Validate `EOFFICE_IM_BASE_URL` before connecting and reject plaintext schemes unless an explicit development-only override is enabled. 3. Configure normal TLS certificate and hostname verification. Do not document options that disable certificate validation. 4. Remove `text_message_content` from transmitted payloads when message confidentiality is expected. If server-side search or rendering requires plaintext, clearly state that the design is not end-to-end encrypted. 5. Define an explicit encryption model, including key generation, key distribution, key rotation, authenticated encryption, and whether the server is intended to decrypt messages. 6. Prefer an authenticated-encryption construction such as AES-GCM. If CBC must be retained, add a secure integrity mechanism and require fresh, unpredictable IVs. 7. Prevent OA tokens and plaintext messages from being written to application, proxy, monitoring, or debugging logs. 8. Use short-lived, narrowly scoped tokens and implement revocation and rotation procedures for suspected exposure. 9. Enforce server-side authorization independently for every message, group-management, presence, and offline-message event. Do not trust client-supplied sender IDs, user IDs, room IDs, or membership lists. 10. Update all examples in `SKILL.md`, `README.md`, and `references/im-api.md` so secure transport and non-plaintext message handling are the documented defaults.