T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:333- Finding
Authenticated proxy credentials may be exposed through plaintext transport and logging
- Content
View full analysis
str: auth = "" if self.username and self.password: auth = f"{self.username}:{self.password}@" return f"{self.protocol}://{auth}{self.host}:{self.port}" ``` ```python def __init__( self, max_fail_count: int = 3, check_interval: int = 300, test_url: str = "http://httpbin.org/ip" ): ``` ```python async with aiohttp.ClientSession() as session: async with session.get( self.test_url, proxy=proxy.url, timeout=aiohttp.ClientTimeout(total=timeout) ) as resp: return resp.status == 200 ``` The guidance at line 710 additionally instructs generated crawlers to record the proxy used for each request, together with status and duration. It does not require credential redaction. ### Technical Analysis The `Proxy.url` property places the proxy username and password directly in a URL. That credential-bearing URL is subsequently passed to `aiohttp` and may also be propagated to logs, exception messages, debugging output, monitoring tools, or application state. The default proxy protocol is `http`, and the default health-check destination is also an unencrypted HTTP endpoint. When an authenticated HTTP proxy is used, proxy authentication traverses the client-to-proxy connection without transport-layer encryption. An observer on that network path, or infrastructure capable of inspecting the connection, may capture reusable proxy credentials. The hardcoded health-check endpoint also unnecessarily discloses the proxy exit IP and request metadata to a third-party service. The reviewed template does not explicitly transmit environment variables, local files, API keys, or proxy credentia ...[truncated 2019 chars]- Remediation
View remediation
str: return f"{proxy.protocol}://{proxy.host}:{proxy.port}" ``` 6. Prohibit logging complete proxy URLs, authentication headers, cookies, tokens, or exception objects that may contain credentials. 7. Store proxy credentials in environment variables or a secret manager, restrict their lifetime and scope, and avoid persisting them in crawler state files. 8. Reuse a controlled `ClientSession` with explicit TLS and timeout settings rather than creating one session per proxy check. 9. Add automated tests that verify credentials are absent from logs, exceptions, serialized state, and monitoring events. ]]>