T09 · Insecure Skill Coding Practices
Error
- Location
- skill.md:53
- Finding
- Sensitive device identifiers are transmitted without locally enforced consent or TLS validation## Vulnerability Details **File Location**: `skill.md`, lines 53-70 **Vulnerability Type**: Missing authorization enforcement and transport validation **Risk Level**: High ### Vulnerable Code ```python def submit_edge_local_payload(local_tls_socket, gene_code, mac_address): vtm_payload = { "local_auth_only": { "gene_code": gene_code, "mac_address": mac_address, "temp_id": FACTORY_TEMP_ID }, "6d_manifesto": { "1_product_name": "Smart Temp Sensor Pro", "2_product_category": "Environmental Sensor", "3_vendor_full_name": "RobotZero Hardware Dept", "4_vendor_website": "https://space2.world/developer", "5_quality_certs": ["ISO9001"], "6_specific_licenses": ["S2-Class-A"] } } local_tls_socket.send(json.dumps(vtm_payload).encode()) ``` ### Technical Analysis The reference function serializes and transmits the device's Gene Code, MAC address, temporary identifier, and vendor manifest through a caller-supplied socket. It does not verify that the user has explicitly authorized the operation, establish TLS 1.3 itself, authenticate the remote peer, validate a certificate chain or hostname, or confirm that the destination is a trusted local host. The parameter name `local_tls_socket` does not enforce either locality or TLS. A plain socket, a TLS connection without certificate validation, or a socket connected to an attacker-controlled LAN service can be supplied. This conflicts with the project's stated requirements that sensitive identifiers remain local and that the handshake occur only after explicit user approval. Because this is developer guidance intended to be copied into firmware, the missing controls can propagate into downstream implementations. ### Attack Path 1. An attacker operates a service on the victim's local network or influences endpoint disco ...[truncated 1058 chars]
- Remediation
- ## Remediation Suggestions - Require an explicit, authenticated user-consent token and verify it immediately before transmitting sensitive data. - Create the TLS connection inside the function rather than accepting an arbitrary connected socket. - Require TLS 1.3, validate the complete certificate chain and expected hostname or device identity, and fail closed on every validation error. - Bind connections to an explicitly selected local endpoint and reject redirects or destinations outside approved local address ranges. - Use certificate or public-key pinning where the local-host trust model supports it. - Apply message framing and use `sendall` or an equivalent operation so partial sends cannot silently truncate the payload. - Minimize transmitted fields, keep sensitive values in memory only as long as necessary, and securely discard them after authorization. - Add tests proving that transmission cannot occur before consent, through plaintext sockets, or to unauthenticated peers.