T09 · Insecure Skill Coding Practices
- Location
scripts/mybooks_tts_api.py:31- Finding
Administrator Credentials and API Keys May Be Transmitted over an Untrusted Transport
- Content
View full analysis
Vulnerability Details
File Location:
scripts/mybooks_tts_api.py:31, 98, 108-121, 139-149;SKILL.md:14-17
Vulnerability Type: Configurable plaintext transport and optional TLS certificate-verification bypass
Risk Level: MediumVulnerable Code
python urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)python self.verify_ssl = os.environ.get("MYBOOKS_SSL_VERIFY", "true").lower() in ("true", "1", "yes")python def sign_in(self) -> None: """Authenticate with the server and store session cookies.""" url = f"{self.host}/api/user/sign_in" data = f"username={self.username}&password={self.password}" try: resp = self.requests.post( url, data=data, headers={"Content-Type": "application/x-www-form-urlencoded"}, timeout=30, verify=self.verify_ssl ) resp.raise_for_status() result = resp.json()python url = f"{self.host}{path}" kwargs.setdefault('cookies', self.session_cookies) kwargs.setdefault('timeout', 30) kwargs.setdefault('verify', self.verify_ssl) try: resp = self.requests.request(method, url, **kwargs)The documentation actively demonstrates configurations that use plaintext HTTP and disable certificate verification:
bash export MYBOOKS_HOST="http://127.0.0.1:8082" export MYBOOKS_USER="admin" export MYBOOKS_PASSWORD="your_password" export MYBOOKS_SSL_VERIFY="false" # For a self-signed server certificateTechnical Analysis
The client sends an administrator username and password to the configured
MYBOOKS_HOST, retains authenticated session cookies, and subsequently sends those cookies with every API request. Configuration and conversion operations can also transmit a third-party TTS API key.TLS verification defaults to enabled, but the user can disable it through `MYBOOKS_SSL ...[truncated 2523 chars]
- Remediation
View remediation
Remediation Suggestions
- Require
https://for every non-loopback host. Reject plaintext HTTP unless the parsed host is an actual loopback address such as127.0.0.1or::1. - Do not permit certificate verification to be disabled for remote hosts. For self-signed deployments, accept a path to a trusted private CA bundle and pass that path through
verify. - Remove the global suppression of
InsecureRequestWarning. If an exceptional insecure mode remains available, emit a prominent warning for every invocation. - Validate the final parsed URL, including scheme, hostname, and port, rather than relying on string-prefix checks.
- Encode login credentials using the request library:
python resp = self.requests.post( url, data={"username": self.username, "password": self.password}, timeout=30, verify=self.verify_ssl, ) - Prefer short-lived, narrowly scoped API tokens over reusable administrator passwords where the server supports them.
- Update the documentation to demonstrate HTTPS by default and clearly restrict any HTTP example to a loopback-only development deployment.
- Require