T09 · Insecure Skill Coding Practices
Error
- Location
scripts/compile-project.sh:120- Finding
TLS Certificate Verification Is Disabled for Sensitive Server Operations
- Content
View full analysis
/dev/null); then ``` ```bash SUBMIT=$(curl -skf -X POST "$SERVER/api/compile" \ -F "file=@$ZIP_FILE" 2>/dev/null) ``` ```bash if ! curl -skf -o "$OUTPUT" "$SERVER/api/build/$BUILD_ID/download" 2>/dev/null; then echo "❌ Firmware download failed" exit 1 fi ``` ```bash for FILE in bootloader partitions firmware; do if ! curl -skf -o "$FLASH_DIR/${FILE}.bin" "$SERVER/api/build/$BUILD_ID/file/${FILE}.bin" 2>/dev/null; then echo "❌ Failed to download ${FILE}.bin" exit 1 fi done ``` The PowerShell implementation uses the same insecure option: ```powershell $SubmitRaw = & curl.exe -skf -X POST "$Server/api/compile" -F "file=@$ZipFile" ``` ```powershell & curl.exe -skf -o $Target "$Server/api/build/$BuildId/file/$File.bin" ``` ### Technical Analysis The `-k`/`--insecure` option disables TLS certificate and hostname verification. Although the connection remains encrypted, the client no longer verifies that it is communicating with the intended compile server. This affects all sensitive stages of the workflow: - Uploading the complete project archive. - Receiving compilation status and build identifiers. - Downloading combined and individual firmware images. - Retrieving the flash manifest. - Triggering server-side flashing. A network-positioned attacker can present any certificate and impersonate the compile server. The helper performs no firmware signature, checksum, or provenance verification after downloading binaries. Consequently, transport-layer impersonation can directly become firmware substitution. The flagged pipelines at `SKILL.md:173` and `scripts/com ...[truncated 1574 chars]- Remediation
View remediation