T09 · Insecure Skill Coding Practices
- Location
SKILL.md:245- Finding
API Credential Exposure Through Plaintext HTTP
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 245–251
Vulnerability Type: Plaintext transmission of sensitive credentials and data
Risk Level: MediumVulnerable Code
bash curl "http://worldtimeapi.org/api/timezone/Asia/Shanghai"bash curl "http://api.timezonedb.com/v1/get-time-zone?key=YOUR_API_KEY&by=zone&zone=Asia/Shanghai"Technical Analysis
The documented TimezoneDB command instructs users to place an API key in the query string of a request sent over unencrypted HTTP. Because HTTP provides neither transport confidentiality nor server authenticity, an attacker able to observe or modify network traffic can capture the API key, inspect the request, or tamper with the returned time information.
Embedding the credential in the URL creates additional exposure risks because complete URLs may be retained in shell history, diagnostic output, HTTP proxy logs, and server access logs. The World Time API command is also sent over HTTP, allowing an on-path attacker to alter its response even though that particular request contains no credential.
Attack Path
- A user replaces
YOUR_API_KEYwith a valid TimezoneDB credential. - The user executes the documented
curlcommand. - The request and API key travel over plaintext HTTP.
- An attacker controlling or monitoring a network intermediary captures the request.
- The attacker extracts and reuses the API key for unauthorized API requests.
- Alternatively, the attacker modifies an HTTP response to provide false time data to a consuming script or application.
Impact Assessment
Successful exploitation does not directly grant local host privileges. It can expose the TimezoneDB account credential to unauthorized parties, permitting API use within the key's assigned quota and permissions. It may lead to quota exhaustion, service charges where applicable, service disruption, or inaccurate time-dependent application behavior.
The scope is limited to users who ...[truncated 152 chars]
- A user replaces
- Remediation
View remediation
Remediation Suggestions
- Replace all plaintext HTTP API endpoints with supported HTTPS endpoints.
- Avoid placing API credentials directly in command text or documentation examples.
- Read credentials from a protected environment variable or secret manager.
- Prefer an authorization header instead of a query parameter when the service supports it.
- Ensure scripts do not enable shell tracing when handling credentials.
- Warn users that URL query parameters may be recorded in shell history, proxy logs, and server logs.
- Validate HTTPS certificates normally and do not recommend options such as
curl --insecure.
A safer pattern, subject to the provider's supported HTTPS interface, is:
bash read -r -s TIMEZONEDB_API_KEY export TIMEZONEDB_API_KEY curl --fail --show-error --silent \ --get "https://api.timezonedb.com/v1/get-time-zone" \ --data-urlencode "key=${TIMEZONEDB_API_KEY}" \ --data-urlencode "by=zone" \ --data-urlencode "zone=Asia/Shanghai" unset TIMEZONEDB_API_KEYIf the provider supports header-based authentication, use that mechanism instead so the credential is not included in the URL.