T09 · Insecure Skill Coding Practices
Warning
- Location
- SKILL.md:180
- Finding
- API Credential Transmitted Over Plaintext HTTP<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 180–184 **Vulnerability Type**: Plaintext transmission of sensitive credentials **Risk Level**: Medium ### Vulnerable Code ```python API_KEY = 'твой_ключ_сюда' CITIES = ['Moscow', 'Saint Petersburg', 'Novosibirsk'] def get_weather(city): url = f"http://api.openweathermap.org/data/2.5/weather?q={city}&appid={API_KEY}&units=metric" ``` ### Technical Analysis The documented example places an API key in a query-string parameter and sends the request over unencrypted HTTP. Because HTTP provides neither transport confidentiality nor server authentication, an attacker capable of observing or modifying the network connection can capture the `appid` value or tamper with the API response. Embedding the credential in the URL also increases exposure because complete URLs may be recorded by application logs, debugging tools, HTTP proxies, monitoring products, or network infrastructure. Although the value shown is a placeholder, the instructions expect users to replace it with a real credential. Copying the example as written would expose that credential. ### Attack Path 1. A user copies the example and replaces `твой_ключ_сюда` with a valid OpenWeather API key. 2. The user runs the script on a network observed or controlled by an attacker, such as an untrusted wireless network. 3. The script sends an HTTP request containing the key in the `appid` query parameter. 4. The attacker reads the plaintext request and extracts the API key. 5. The attacker may submit unauthorized requests using the stolen key or modify weather responses returned to the script. ### Impact Assessment The attacker can obtain the exposed OpenWeather API credential and use it within the permissions and quota assigned to that key. Potential consequences include unauthorized API usage, quota exhaustion, unexpected charges where applicable, service disruption, and credential disclosure through intermediary logs. The iss ...[truncated 179 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Replace the endpoint with its HTTPS equivalent: ```python url = f"https://api.openweathermap.org/data/2.5/weather?q={city}&appid={API_KEY}&units=metric" ``` 2. Retrieve the credential from an environment variable or secret manager instead of placing it directly in source code: ```python import os API_KEY = os.environ["OPENWEATHER_API_KEY"] ``` 3. Avoid recording full URLs when they contain query-string credentials. Redact the `appid` parameter from application and proxy logs. 4. Configure an explicit timeout and retain TLS certificate verification, which is enabled by default in `requests`. 5. Rotate any real API key that has previously been used with the plaintext endpoint. 6. Where supported by the provider, apply usage limits and restrictions to reduce the impact of credential theft. ]]>