T09 · Insecure Skill Coding Practices
Error
- Location
SKILL.md:17- Finding
Seerr API Key May Be Transmitted Over Plaintext HTTP
- Content
View full analysis
:5055` for remote) ``` ```bash curl -s -H "X-Api-Key: $SEERR_API_KEY" \ "$SEERR_URL/api/v1/search?query=PERCENT_ENCODED_QUERY&page=1&language=en" ``` The same API-key header and configurable base URL are also used by the state-changing request examples on lines 37-53 and the status calls on lines 59-61. ### Technical Analysis The documented configuration explicitly permits a remote Seerr server to use an unencrypted `http://` URL. All Seerr requests transmit the reusable `SEERR_API_KEY` in the `X-Api-Key` HTTP header. When plain HTTP is used, neither the credential nor the request and response content receives transport confidentiality or server authentication. An attacker with a suitable network position can inspect the traffic, capture the API key, modify responses, or redirect requests. The Skill does not require HTTPS, reject insecure remote URLs, or provide equivalent transport-security safeguards. ### Attack Path 1. A user follows the documented configuration and sets `SEERR_URL` to a remote `http://:5055` endpoint. 2. The Skill searches, checks status, or creates a media request. 3. The HTTP request carries `SEERR_API_KEY` in the plaintext `X-Api-Key` header. 4. An attacker controlling or monitoring a relevant network segment captures the request. 5. The attacker extracts the reusable API key. 6. The attacker submits independent requests to the Seerr API using the permissions associated with that key. This path requires network visibility or an equivalent ability to intercept plaintext traffic between the agent and Seerr. ### Impact Assessment A successful attacker can obtain the Seerr API key and exerci ...[truncated 533 chars]- Remediation
View remediation