T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:22- Finding
Authentication and Gameplay Data Transmitted over Unencrypted HTTP
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 22-123
Vulnerability Type: Plaintext transmission of sensitive authentication and session data
Risk Level: MediumThe Skill directs the Agent to communicate with a hard-coded bare IP address exclusively over unencrypted HTTP. The affected commands include account registration, session creation, gameplay actions, session termination, score retrieval, and leaderboard access.
Representative vulnerable code from the registration and authenticated session flows:
bash API_BASE=http://111.231.112.127:9000bash NICKNAME="玩家昵称" TS=$(date +%s) RESULT=$(curl -s -X POST "http://111.231.112.127:9000/v1/auth/register" \ -H "Content-Type: application/json" \ -d "{\"email\":\"player_${TS}@aw.ai\",\"password\":\"aw_${TS}\",\"nickname\":\"${NICKNAME}\"}") echo "$RESULT"bash TOKEN="上一步获取的player_token" RESULT=$(curl -s -X POST "http://111.231.112.127:9000/v1/session/start" \ -H "Content-Type: application/json" \ -H "Authorization: Bearer $TOKEN" \ -d '{"world_id":"wld_01KNNVGG1PXE6GPHQ0CNMS4WJ1","model_id":"openclaw","client_version":"5.0.0"}') echo "$RESULT"bash RESULT=$(curl -s -X POST "http://111.231.112.127:9000/v1/session/action" \ -H "Content-Type: application/json" \ -H "Authorization: Bearer $TOKEN" \ -d "{\"session_id\":\"$SESSION_ID\",\"turn\":$TURN,\"action\":\"$ACTION\",\"payload\":$PAYLOAD,\"ts_ns\":\"$(date +%s)000000000\",\"prev_hash\":\"\",\"entry_hash\":\"h_$TURN\"}") echo "$RESULT"bash curl -s -X POST "http://111.231.112.127:9000/v1/session/end" \ -H "Content-Type: application/json" \ -H "Authorization: Bearer $TOKEN" \ -d "{\"session_id\":\"$SESSION_ID\",\"end_reason\":\"victory\",\"final_turn\":$TURN,\"chain_root_hash\":\"cli\"}" curl -s "http://111.231.112.127:9000/v1/session/$SESSION_ID/score" \ -H "Authorization: Bearer $TOKEN" curl -s "http://111. ...[truncated 2752 chars]- Remediation
View remediation
Remediation Suggestions
- Place the API behind HTTPS on a controlled domain and replace every
http://111.231.112.127:9000reference with anhttps://URL. - Configure a certificate issued for the API hostname by a trusted certificate authority. Do not disable certificate verification with options such as
curl -k. - Redirect or reject all plaintext HTTP requests so credentials cannot accidentally be transmitted through the legacy endpoint.
- Use short-lived, narrowly scoped bearer tokens and revoke them when the session ends. Implement rotation and replay protections where feasible.
- Avoid returning credentials or tokens in logs and command output. Parse only the required response fields and prevent sensitive values from being exposed in Agent narration.
- Minimize transmitted user-controlled data and explicitly disclose what nickname, dialogue, memory, and gameplay information is sent to the remote service.
- Add authenticated response-integrity protections at the application level if requests pass through infrastructure where TLS terminates before reaching the game service.
- Document token lifetime, revocation behavior, server ownership, data retention, and privacy controls.
- Place the API behind HTTPS on a controlled domain and replace every