T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:16- Finding
Unencrypted Communication with External Game APIs
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 16-42
Vulnerability Type: Plaintext HTTP communication with external services
Risk Level: MediumVulnerable Code
markdown - **Game State**: `http://3.249.37.173:8081/state` - **Strategy API**: `http://3.249.37.173:8082` - **Chat**: `http://3.249.37.173:8081/chat?name=YourAgent&msg=Hello` ## Quick Start ```python import requests import urllib.parse GAME = "http://3.249.37.173:8081" STRAT = "http://3.249.37.173:8082" NAME = "MyAgent" # Get game state state = requests.get(f"{GAME}/state").json() print(f"Score: CT {state['ctScore']} - T {state['tScore']}") # Send chat message msg = urllib.parse.quote("Let's go boys!") requests.get(f"{GAME}/chat?name={NAME}&msg={msg}") # Call a strategy requests.post(f"{STRAT}/call", json={ "strategy": "rush_b", "agent": NAME })text ### Technical Analysis The documented implementation exchanges game state, chat content, agent names, and gameplay commands with a fixed external IP address over unencrypted HTTP. HTTP provides neither transport confidentiality nor server authenticity and does not protect message integrity. An attacker with a suitable network interception position could read or modify requests and responses. For example, the attacker could return fabricated game-state JSON, alter a strategy request, or modify an outgoing chat message. Because the client immediately parses the external response and uses its fields without authenticating the server or validating the response schema, manipulated state can directly influence subsequent agent behavior. The chat endpoint also transmits the agent name and message through a GET query string. Query strings commonly appear in server, proxy, gateway, monitoring, and browser-history logs, increasing unintended retention and disclosure. The sample requests have no explicit timeout, HTTP status validation, or str ...[truncated 1478 chars]- Remediation
View remediation
Remediation Suggestions
- Publish the APIs through an authenticated HTTPS hostname and redirect or disable plaintext HTTP access.
- Retain normal TLS certificate and hostname verification; do not suppress certificate validation in client code.
- Replace state-changing GET requests with authenticated POST requests. Send chat fields in a request body rather than a query string.
- Add explicit connection and read timeouts, for example:
python response = requests.get(f"{GAME}/state", timeout=(3, 10)) response.raise_for_status() - Validate response content types and enforce a strict schema for fields such as scores, phase, and kills before using the data.
- Authenticate state-changing strategy, claim, and chat operations. Apply authorization controls so one agent cannot operate another agent's slot or identity.
- Add replay protection and request integrity controls where gameplay commands are security-sensitive.
- Avoid hardcoding a bare IP address. Use a controlled DNS name so TLS identity verification and endpoint rotation can be managed safely.
- Apply server-side rate limits, input-length restrictions, logging controls, and output encoding to chat and command endpoints.