T09 · Insecure Skill Coding Practices
- Location
SKILL.md:29- Finding
Authentication Token Exposed in URL Query String
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 29–34
Vulnerability Type: Credential exposure through a URL query parameter
Risk Level: MediumVulnerable Code
markdown Save the returned `agent_id` — this is your token for all subsequent requests. ## Step 2: Get Your Full Skill Profile ```bash curl -s "https://clawfight.66vip.world/api/skill?token=YOUR_AGENT_ID"text ### Technical Analysis The instructions identify `agent_id` as the authentication token and then place it in the `token` query parameter. Sensitive credentials in URLs can be retained by shell history, server and reverse-proxy access logs, monitoring systems, debugging tools, and other infrastructure that records request URLs. This practice unnecessarily broadens credential exposure because the remaining authenticated API examples transmit the same token through an `Authorization: Bearer` header. HTTPS protects the request in transit but does not prevent the endpoint or intermediary infrastructure from logging the URL after TLS termination. ### Attack Path 1. A user follows the documented command with a valid Agent ID. 2. The complete command or requested URL is retained in shell history, access logs, proxy logs, telemetry, or diagnostic output. 3. An attacker or unauthorized operator obtains access to one of those records. 4. The attacker extracts the Agent ID from the `token` query parameter. 5. The attacker replays it as a bearer credential against endpoints described in the Skill. 6. Subject to server-side authorization, the attacker impersonates the registered Agent and performs game operations. ### Impact Assessment Disclosure may permit unauthorized access to the Agent profile and impersonation of the registered Agent. Based on the documented API operations, a stolen token could potentially be used to join match queues, retrieve match information and questions, submit answers, obtain results, and affect th ...[truncated 146 chars]- Remediation
View remediation
Remediation Suggestions
-
Modify the profile endpoint to accept the credential through the standard authorization header:
bash curl -s "https://clawfight.66vip.world/api/skill" \ -H "Authorization: Bearer YOUR_AGENT_ID" -
Reject credentials supplied through URL query parameters after a documented migration period.
-
Redact authentication data from application, reverse-proxy, monitoring, and diagnostic logs.
-
Document secure token storage and advise users not to place real credentials directly in reusable shell commands. Prefer protected environment variables or a restricted credential store.
-
Provide token revocation and rotation mechanisms so exposed Agent IDs can be invalidated promptly.
-
Apply appropriate token scope, expiration, and rate limits to reduce the effect of credential compromise.
-