T09 · Insecure Skill Coding Practices
Error
- Location
SKILL.md:96- Finding
Credentials, bearer tokens, and private sales data transmitted over plaintext HTTP
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md:96-147, 180-264, 360-364, 903-941
Vulnerability Type: Cleartext transmission of sensitive information
Risk Level: CriticalVulnerable Code
bash TOKEN_CACHE=~/.openclaw/workspace/scripts/.token-cache.json FASTAPI_BASE_URL="http://47.116.49.218:8000/api/v1" response=$(curl -s -X POST "${FASTAPI_BASE_URL}/auth/login" \ -H "Content-Type: application/json" \ -d "{\"employee_id\": \"${EMPLOYEE_ID}\", \"password\": \"${PASSWORD}\"}" \ --max-time 120)bash INGEST_PAYLOAD=$(jq -n \ --arg company_name "$company_name" \ --arg project_name "${project_name:-}" \ --arg contact_name "${contact_name:-}" \ --arg transcript_file_path "$target_file" \ --arg visit_date "$visit_date" \ --arg data_source "电话录音转录" \ --argjson sales_stage "$(echo "$parsed_result" | jq '.sales_stage')" \ --argjson follow_up_strategies "$(echo "$parsed_result" | jq '.follow_up_strategies')" \ --argjson customer_insights "$(echo "$parsed_result" | jq '.customer_insights')" \ --argjson commitments "$(echo "$parsed_result" | jq '.commitments')" \ --argjson risk_assessment "$(echo "$parsed_result" | jq '.risk_assessment')" \ --arg raw_analysis "$(echo "$parsed_result" | jq -r '.' | head -c 10000)" \ --arg visit_summary "$(echo "$parsed_result" | jq -r '.visit_summary')" \ '{ company_name: $company_name, project_name: $project_name, contact_name: $contact_name, transcript_file_path: $transcript_file_path, visit_date: $visit_date, data_source: $data_source, sales_stage: $sales_stage, follow_up_strategies: $follow_up_strategies, customer_insights: $customer_insights, commitments: $commitments, risk_assessment: $risk_assessment, raw_analysis: $raw_analysis, visit_summary: $visit_summary }') ingest_response=$(curl -s -X POST "${FASTAPI_BASE_URL}/project-portrait ...[truncated 1950 chars]- Remediation
View remediation
Remediation Suggestions
- Replace all plaintext HTTP endpoints with HTTPS endpoints on a verified organizational domain.
- Enforce valid certificate-chain and hostname verification; do not disable TLS validation.
- Remove the raw-IP service address from the skill and load an administrator-approved endpoint from trusted configuration.
- Obtain explicit user authorization before transferring transcript- or notification-derived information.
- Minimize payloads and avoid transmitting raw analysis, local file paths, or unrelated customer information.
- Use short-lived, audience-restricted access tokens rather than employee passwords after initial authentication.
- Define server-side retention, access-control, encryption-at-rest, and audit-log requirements for uploaded conversation data.
- Revoke credentials and tokens previously transmitted through the plaintext service.