T09 · Insecure Skill Coding Practices
- Location
SKILL.md:111- Finding
Cleartext Transmission of Complete User Documents to a Third-Party API
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md:41,SKILL.md:111-135; also documented inREADME.md:103
Vulnerability Type: Unencrypted transmission of sensitive data
Risk Level: HighVulnerable Code
markdown | Agent API endpoint (upload/poll/internal download) | `http://47.103.80.109:8080` |bash API="${PINGAI_PPT_API_URL:-http://47.103.80.109:8080}"bash curl -sS \ -F "file=@$FILE" \ -F "theme=$THEME" \ "$API/v1/jobs"bash curl -sS \ -F "file=@$FILE" \ -F "mode=convert_only" \ "$API/v1/jobs"The same insecure default is exposed to users in
README.md:bash export PINGAI_PPT_API_URL=http://47.103.80.109:8080 # Agent APITechnical Analysis
The skill instructs the Agent to upload complete user documents to a third-party service using plain HTTP. HTTP provides neither transport encryption nor cryptographic authentication of the remote server.
Although the documentation discloses that files leave the local system and requires user consent, consent to cloud processing does not mitigate insecure transport. Any party capable of observing or modifying traffic between the Agent and the API can inspect the multipart upload, replace the submitted document, alter job-status responses, or modify internal download responses.
The direct use of an IP address over HTTP also prevents normal HTTPS hostname and certificate validation. The API is documented as requiring no authentication, further reducing protection against unauthorized submission and interaction with job endpoints.
Attack Path
- A user invokes the skill with a PDF, DOCX, PPTX, Markdown, or text document and consents to third-party processing.
- The Agent selects the default endpoint
http://47.103.80.109:8080. curlsends the complete file in a plaintext multipart HTTP request to/v1/jobs.- An attacker positioned on the local network, gateway, ISP path, compromised proxy, or another relevant network segment cap ...[truncated 1108 chars]
- Remediation
View remediation
Remediation Suggestions
-
Provide the API exclusively through HTTPS with a certificate issued for a validated hostname.
-
Replace the default endpoint with an HTTPS URL, for example:
bash API="${PINGAI_PPT_API_URL:-https://api.ppt.siping.me}" -
Remove all documented HTTP fallbacks and fail closed if the configured URL does not use HTTPS.
-
Preserve standard
curlcertificate and hostname verification. Do not add--insecureor otherwise disable TLS validation. -
Add authenticated API access using short-lived, narrowly scoped credentials rather than leaving upload and job APIs unauthenticated.
-
Ensure job identifiers are cryptographically unpredictable and enforce authorization checks on polling and download endpoints.
-
Protect generated-file links with short-lived signed tokens and prevent unauthorized enumeration or retrieval.
-
Validate that any
download_urlreturned by the service uses HTTPS and belongs to an approved host before presenting or following it. -
Consider end-to-end file encryption where documents may contain sensitive information, with decryption restricted to the intended processing environment.
-
Update
README.md,SKILL.md, examples, and environment-variable guidance to remove the direct plaintext IP endpoint. -
Conduct transport-security testing to verify TLS enforcement, certificate validation, HTTP-to-HTTPS rejection, and resistance to on-path response modification.
-