T09 · Insecure Skill Coding Practices
Error
- Location
- scripts/reconnect-adb.sh:15
- Finding
- TLS Certificate Verification Disabled on the Device-Control Channel<![CDATA[ ## Vulnerability Details **File Location**: `scripts/reconnect-adb.sh:15-28`; `SKILL.md:88-98` **Vulnerability Type**: TLS verification bypass affecting authenticated remote device-control requests **Risk Level**: High ### Vulnerable Code ```bash RESULT=$(curl -sk -X POST "$BACKEND/api/adb/connect" \ -H "Content-Type: application/json" \ -H "x-clawpaw-secret: $SECRET" \ -d "{\"uid\":\"$UID\"}") echo "$RESULT" if echo "$RESULT" | grep -q "already connected\|connected to"; then echo "" echo "OK — testing with press_key home..." curl -sk -X POST "$BACKEND/api/adb/press_key" \ -H "Content-Type: application/json" \ -H "x-clawpaw-secret: $SECRET" \ -d "{\"uid\":\"$UID\",\"key\":\"home\"}" ``` The setup guide repeats the same unsafe option: ```bash curl -sk -X POST https://www.clawpaw.me/api/adb/press_key \ -H "Content-Type: application/json" \ -H "x-clawpaw-secret: <SECRET>" \ -d '{"uid":"<UID>","key":"home"}' curl -sk -X POST https://www.clawpaw.me/api/adb/screenshot \ -H "Content-Type: application/json" \ -H "x-clawpaw-secret: <SECRET>" \ -d '{"uid":"<UID>"}' ``` ### Technical Analysis The `-k`/`--insecure` curl option disables TLS certificate and hostname verification. Encryption alone is insufficient when the server identity is not authenticated: a machine-in-the-middle can present an arbitrary certificate and terminate the connection. These requests carry the reusable `x-clawpaw-secret` credential and invoke high-impact phone-control operations, including establishing the ADB connection, pressing device keys, and retrieving screenshots. Consequently, this is not merely a confidentiality weakness; it compromises the authentication and integrity of the remote device-control channel. ### Attack Path 1. An attacker obtains a network interception position, such as through a malicious Wi-Fi access point, compromised proxy, DNS manipulation, or routing attack. 2. The attacker redirects or intercepts traffic int ...[truncated 1176 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Remove `-k` from every curl command and require standard certificate-chain and hostname verification. 2. Fail closed on all certificate and TLS errors; do not retry with certificate validation disabled. 3. Use a current CA trust store and document how to repair certificate configuration rather than bypassing it. 4. Consider certificate or public-key pinning for this high-privilege control channel, with a secure rotation process. 5. Replace reusable device secrets with short-lived, narrowly scoped access tokens. 6. Bind tokens to the intended device, operation, client, and expiration time where feasible. 7. Rotate existing secrets because prior use over an unauthenticated TLS channel may have exposed them. 8. Add automated checks that reject `curl -k`, `--insecure`, or equivalent TLS bypasses in security-sensitive scripts. ]]>