T09 · Insecure Skill Coding Practices
Warning
- Location
references/recipes.md:41- Finding
Hardcoded Plaintext WebSocket Endpoint in Voice Navigation Recipe
- Content
View full analysis
{ await routeByIntent(text); }} onVoiceError={(err) => console.error(err)} longPressMs={200} wsUrl="ws://localhost:8765" > {children} ; ``` ### Technical Analysis The voice-navigation recipe assigns the ASR endpoint using a hardcoded `ws://localhost:8765` URL. The `ws://` scheme does not provide transport encryption or endpoint authentication. The example also provides no mechanism for authenticating the ASR service. This contradicts the project's own requirement in `references/guardrails.md:18`, which states that the WebSocket URL and ASR authentication must come from application configuration rather than hardcoded values. Because this file is an implementation recipe intended to be copied into generated applications, developers may deploy the pattern without validating the endpoint, enforcing secure transport, or authenticating the receiving service. Although the example points to localhost, a process under another user's control or a compromised local process may bind to the expected port. If developers replace the host but retain the plaintext scheme, network-positioned attackers may intercept or modify the WebSocket traffic. ### Attack Path 1. A developer copies the voice-navigation recipe into an application. 2. The application opens an unauthenticated plaintext connection to `ws://localhost:8765`. 3. An attacker-controlled or compromised local process listens on port `8765`, or the endpoint is changed to a remote host while retaining `ws://`. 4. The application connects to the untrusted service without validating its identity. 5. Voice-related data sent through the ASR channel may be observed, retained, or manipulated by the attacker. 6. Manipulated ASR responses may be ...[truncated 824 chars]- Remediation
View remediation
{ await routeByIntent(validateVoiceIntent(text)); }} onVoiceError={handleVoiceError} longPressMs={200} wsUrl={asrUrl} > {children} ; ``` ]]>