T09 · Insecure Skill Coding Practices
- Location
scripts/fetch-health.py:32- Finding
Credentials, bearer tokens, and health data may be transmitted over plaintext HTTP
- Content
View full analysis
Vulnerability Details
File Location:
config.example.json:2-4;scripts/fetch-health.py:32-43
Vulnerability Type: Plaintext transmission of credentials and sensitive medical data
Risk Level: HighVulnerable Code
json { "base_url": "http://YOUR_SERVER_IP_OR_HOSTNAME:6644", "username": "YOUR_USERNAME", "password": "YOUR_PASSWORD", "language": "en", "timezone": "Europe/Berlin", "vault_path": "/path/to/your/obsidian/vault", "log_dir": "30 Bereiche/Gesundheit/Logs/GTR3" }python def api_post(url, payload, token=None): data = json.dumps(payload).encode() headers = {"Content-Type": "application/json"} if token: headers["Authorization"] = f"Bearer {token}" req = urllib.request.Request(url, data=data, headers=headers, method="POST") with urllib.request.urlopen(req, timeout=15) as r: return json.loads(r.read()) def login(base_url, username, password): resp = api_post(f"{base_url}/api/v2/login", {"username": username, "password": password}) return resp["token"]Technical Analysis
The example configuration explicitly permits an arbitrary server IP or hostname while using plaintext HTTP. The HTTP helper sends the configured username and password in a JSON login request and subsequently places the returned bearer token in the
Authorizationheader.The same transport is then used to retrieve sensitive health information, including sleep sessions, heart-rate samples, resting heart rate, blood-oxygen saturation, steps, and distance. Plain HTTP provides neither transport confidentiality nor authenticated server identity.
Although HTTP may be reasonable for a service strictly bound to
127.0.0.1, the example encourages use of a remote hostname or IP address. The implementation does not reject plaintext HTTP for non-loopback destinations or warn the user before transmitting credentials.Attack Path
- A user copies
config.example.jsonand configures a LAN or remote H ...[truncated 1274 chars]
- A user copies
- Remediation
View remediation
Remediation Suggestions
- Require HTTPS whenever
base_urlis not a loopback address. - Reject configurations using plaintext HTTP with remote hostnames or non-loopback IP addresses.
- Retain normal TLS certificate and hostname validation; do not add an unverified SSL context.
- If local HTTP support is necessary, explicitly restrict and document it for
127.0.0.1,::1, or a Unix-domain proxy. - Change the example configuration to an HTTPS URL and explain certificate requirements.
- Store credentials in an operating-system secret store or credential manager rather than ordinary JSON where practical.
- If a configuration file remains necessary, require restrictive permissions such as owner-only read/write access.
- Use narrowly scoped, short-lived tokens and revoke tokens after suspected interception.
- Avoid logging credentials, tokens, or raw gateway responses.
- Require HTTPS whenever