T09 · Insecure Skill Coding Practices
Error
- Location
SKILL.md:25- Finding
Disabled TLS Certificate Verification in Pasteclaw API Requests
- Content
View full analysis
Hello","css":"h1{color:#111}","js":""}' ``` ``` The same insecure `curl -sk` pattern is used throughout the Skill for snippet creation, metadata submission, session grouping, updates, and deletion. ### Technical Analysis The `-k` option, also known as `--insecure`, instructs curl not to validate the remote server's TLS certificate. Although the URL uses HTTPS, disabling certificate validation prevents the client from confirming that it is communicating with the legitimate Pasteclaw server. An active network attacker can present a forged certificate and impersonate `pasteclaw.com`. Because the documented command accepts invalid certificates, the connection proceeds without an identity-verification failure. The attacker can then inspect or modify submitted content, authorization headers, API responses, and returned URLs. This behavior is unnecessary for the declared snippet-publishing functionality and exceeds acceptable security requirements. The supplied Python fallback uses normal certificate validation, demonstrating that bypassing TLS validation is not functionally required. ### Attack Path 1. An agent follows the documented `curl -sk` commands to publish, modify, or delete a snippet. 2. An attacker with control over a network path, proxy, DNS response, or compromised access point redirects or intercepts the request. 3. The attacker presents a certificate that is not valid for the legitimate Pasteclaw service. 4. Curl accepts the forged certificate because the `-k` option disabl ...[truncated 1156 chars]- Remediation
View remediation
Hello","css":"h1{color:#111}","js":""}' ``` 2. Update all create, update, delete, metadata, and session-key examples consistently. 3. Fail closed when certificate verification fails rather than retrying with `--insecure`. 4. If a private certificate authority must be supported, document use of a narrowly scoped trusted CA file, such as `--cacert /path/to/trusted-ca.pem`, rather than disabling validation globally. 5. Warn users not to publish credentials, personal data, proprietary material, production configurations, or other secrets. 6. Treat session keys and edit tokens as credentials: keep them out of logs, command histories, URLs, and diagnostic output. ]]>