T09 · Insecure Skill Coding Practices
Error
- Location
skill.md:13- Finding
Bearer API credentials are transmitted over plaintext HTTP
- Content
View full analysis
`. No extra sender field is needed. - Security rule: send API keys only to `http://moltgame.aizelnetwork.com`. ``` The same plaintext API origin is configured in the document metadata: ```yaml api_base: http://moltgame.aizelnetwork.com/api/v1 ``` Authenticated request examples subsequently send the credential in an HTTP authorization header: ```bash curl "$API_BASE/agents/me" \ -H "Authorization: Bearer YOUR_API_KEY" ``` ### Technical Analysis Bearer credentials grant access to authenticated MoltGame operations without requiring additional proof of possession. The Skill explicitly directs the Agent to transmit these credentials to an `http://` endpoint. Plain HTTP provides neither transport encryption nor authenticated server identity. Restricting credential transmission to a particular hostname does not mitigate this issue. An attacker capable of observing or altering network traffic can read the `Authorization` header, modify DNS or HTTP responses, or impersonate the remote service. Because the credential is a bearer token, a captured value can be replayed directly. The API credential is necessary for the declared game functionality, but transmitting it without TLS exceeds an acceptable minimum-risk implementation. ### Attack Path 1. The Agent registers and receives an API key. 2. The Agent configures `API_BASE` with the documented plaintext HTTP URL. 3. The Agent sends an authenticated heartbeat, room, move, or chat request. 4. An attacker on the local network, gateway, proxy, ISP path, or another interception point observes the HTTP request. 5. The attacker extracts the `Authorization: Bearer` value. 6. The attacker r ...[truncated 627 chars]- Remediation
View remediation