T09 · Insecure Skill Coding Practices
Warning
- Location
- scripts/tasks.py:24
- Finding
- Bearer Token and Task Data Exposure over Plaintext HTTP## Vulnerability Details **File Location**: `scripts/tasks.py:24-45`; insecure HTTP configuration is also documented in `SKILL.md:15` **Vulnerability Type**: Transmission of sensitive information over an unencrypted channel **Risk Level**: Medium ### Vulnerable Code ```python HOST = os.environ.get("TASKTROVE_HOST", "").rstrip("/") TOKEN = os.environ.get("TASKTROVE_TOKEN", "") if not HOST: print("Error: TASKTROVE_HOST environment variable is not set") print("Example: export TASKTROVE_HOST='http://localhost:3333'") sys.exit(1) API = f"{HOST}/api/v1" def _make_request(url, data=None, method="GET"): """Make an API request with optional auth.""" headers = {"Content-Type": "application/json"} if TOKEN: headers["Authorization"] = f"Bearer {TOKEN}" req = urllib.request.Request( url, data=json.dumps(data).encode() if data else None, headers=headers, method=method ) with urllib.request.urlopen(req, timeout=10) as resp: return json.load(resp) ``` The configuration documentation also recommends a plaintext endpoint: ```bash export TASKTROVE_HOST="http://your-server:3333" ``` ### Technical Analysis The CLI accepts an arbitrary `TASKTROVE_HOST` URL without validating its scheme. When `TASKTROVE_TOKEN` is configured, `_make_request` places that secret in an HTTP `Authorization: Bearer` header regardless of whether the destination uses HTTPS. Both the documentation and the missing-host error message demonstrate HTTP configurations. While loopback HTTP may be acceptable under a limited local deployment model, the documented `http://your-server:3333` example encourages plaintext communication with a potentially remote server. HTTP provides neither transport confidentiality nor server authentication. A network-positioned attacker can therefore observe the bearer token and task content or tamper with requests and re ...[truncated 1481 chars]
- Remediation
- ## Remediation Suggestions 1. Require `https://` whenever `TASKTROVE_TOKEN` is present and terminate with a clear error if an authenticated plaintext URL is supplied. 2. Reject remote HTTP endpoints by default. If HTTP is needed for local development, restrict it to explicit loopback destinations such as `127.0.0.1`, `localhost`, or `::1`. 3. Provide a deliberate opt-in override for exceptional trusted development environments, accompanied by a prominent warning. Do not enable that override by default. 4. Replace all remote HTTP examples in `SKILL.md` with HTTPS examples and document that bearer credentials must never be sent over plaintext transport. 5. Preserve normal TLS certificate and hostname verification. Do not address this issue by disabling certificate validation. 6. Consider validating the configured URL at startup, allowing only supported `http` or `https` schemes and rejecting embedded credentials, malformed URLs, and unexpected schemes. 7. Rotate any token that may previously have been transmitted to a remote service over plaintext HTTP.