T09 · Insecure Skill Coding Practices
Error
- Location
- SKILL.md:27
- Finding
- API Credential Transmitted Over Unencrypted HTTP## Vulnerability Details **File Location**: `SKILL.md:27-28`, with additional insecure HTTP examples at `SKILL.md:53`, `SKILL.md:63-64`, and `SKILL.md:70-71` **Vulnerability Type**: Plaintext transmission of sensitive credentials **Risk Level**: High ### Vulnerable Code ```text GET http://api.beawan.com/beawanSkill/api/skill/report Header: X-API-KEY: <your-api-key> ``` The returned report URL is also documented as plaintext HTTP: ```json { "code": 0, "data": { "url": "http://api.beawan.com/industry/html/load?name=jm43RF6Yb*K8GjWoO9VbDYxmHGa5rwppT97kMmM4mgM=" } } ``` The usage examples reinforce the insecure transport: ```text GET http://api.beawan.com/beawanSkill/api/skill/report?comCode=000001&year=2024&type=年报 X-API-KEY: sk-your-api-key-here ``` ```text GET http://api.beawan.com/beawanSkill/api/skill/report?comCode=600519&year=2024&type=中报 X-API-KEY: sk-your-api-key-here ``` ### Technical Analysis The Skill instructs clients to send an API credential in the `X-API-KEY` header over plaintext HTTP. HTTP provides neither transport encryption nor server integrity protection. An attacker able to observe or modify network traffic—such as a malicious Wi-Fi operator, compromised router, proxy, ISP-level intermediary, or adjacent network attacker—can capture the API key, inspect requested company and report parameters, or modify the server response. The report URL returned by the service also uses HTTP. Consequently, even if the initial API endpoint were corrected independently, report content could still be intercepted, replaced, or redirected while in transit. ### Attack Path 1. A user configures the Skill with a valid API key. 2. The Agent follows the documented example and sends a request to the HTTP endpoint with the key in the `X-API-KEY` header. 3. An attacker positioned on the network intercepts the unencrypted request and obtains the API key. 4. The ...[truncated 998 chars]
- Remediation
- ## Remediation Suggestions 1. Replace every API and report URL with an authenticated HTTPS endpoint. 2. Configure the server to reject requests carrying credentials over HTTP rather than relying solely on redirects, because the credential is already exposed before an HTTP redirect is received. 3. Enable HTTP Strict Transport Security after validating HTTPS deployment. 4. Use modern TLS configuration, valid certificates, and certificate verification in all clients. 5. Ensure redirects never forward the `X-API-KEY` header to a different origin. 6. Update every documentation example to use `https://api.beawan.com/...`. 7. Rotate API keys that may previously have been transmitted using the documented HTTP endpoint. 8. Apply least-privilege scopes, expiration, revocation, usage quotas, and anomaly monitoring to API keys to limit the consequences of future disclosure. 9. Ensure report pages and all embedded resources are served exclusively through HTTPS to prevent content tampering or mixed-content exposure.