T09 · Insecure Skill Coding Practices
Warning
- Location
- SKILL.md:25
- Finding
- Sensitive and State-Changing Data Transmitted Through GET Query Strings## Vulnerability Details **File Location**: `SKILL.md`, lines 25–44, 132–134, 172–180, and 222–228 **Vulnerability Type**: Sensitive data exposure and unsafe HTTP method usage **Risk Level**: Medium ### Vulnerable Code ```markdown - Method: **GET** for all endpoints (parameters are query strings) ``` ```markdown | `/sms` | Send SMS worldwide | `phone`, `message` | | `/email` | Send email (HTML or plain text) | `to`, `subject`, + `body` or `html` | | `/password/validate` | Check password strength (score 0-4) | `password` (JSON body) | ``` ```markdown ### Password Validate — `GET /password/validate` Checks password strength. Returns a score (0–4) and feedback with suggestions. Send a JSON body: `{ "password": "MySecurePassword123!" }` ``` ```sh curl "https://www.apikiss.com/api/v1/sms?phone=%2B4512345678&message=Hello+from+OpenClaw!" \ -H "Authorization: Bearer $APIKISS_API_KEY" ``` ```sh curl "https://www.apikiss.com/api/v1/email?to=recipient%40example.com&subject=Hello&body=Hi+there" \ -H "Authorization: Bearer $APIKISS_API_KEY" ``` ```markdown Data sent includes only the query parameters you provide (e.g. coordinates, phone number, symbol). Your `APIKISS_API_KEY` is sent as a Bearer token in the Authorization header and never logged locally. ## Security & Privacy - Your API key stays in your environment — never in prompts or logs. - Only the data you explicitly pass as parameters leaves your machine. - API KISS does not store request payloads. ``` ### Technical Analysis The skill directs agents to use HTTP GET requests for every endpoint, including state-changing SMS and email operations. It places recipient identifiers, message subjects, and message bodies directly in URL query strings. URLs may be recorded in client history, reverse-proxy and server access logs, gateway telemetry, monitoring systems, or debugging output. HTTPS protects data in transit but does not prevent U ...[truncated 2466 chars]
- Remediation
- ## Remediation Suggestions 1. Replace GET with POST for SMS, flash SMS, email, and password-validation operations. 2. Put recipients, message contents, and password candidates in request bodies rather than URL query strings. 3. Set an appropriate request content type, such as `application/json`, and reject sensitive parameters supplied in URLs. 4. Do not transmit real passwords to a remote strength-checking service. Perform strength assessment locally with a reviewed library and warn users not to submit active credentials. 5. Require explicit user confirmation immediately before sending an SMS or email, showing the recipient and a safe summary of the content. 6. Add idempotency keys or equivalent replay protection to state-changing endpoints. 7. Configure clients, proxies, gateways, and application servers to redact sensitive URL parameters and request bodies from logs. 8. Correct the password-validation method inconsistency and document exactly which data reaches API KISS and any upstream providers. 9. Replace absolute privacy assurances with verifiable retention, logging, deletion, and third-party-processing policies. 10. Apply rate limits, abuse controls, delivery auditing, and duplicate-request detection to outbound communication endpoints.