T09 · Insecure Skill Coding Practices
Warning
- Location
- SKILL.md:245
- Finding
- API Credential Exposure Through Plaintext HTTP## Vulnerability Details **File Location**: `SKILL.md`, lines 245–251 **Vulnerability Type**: Plaintext transmission of sensitive credentials and data **Risk Level**: Medium ### Vulnerable Code ```bash curl "http://worldtimeapi.org/api/timezone/Asia/Shanghai" ``` ```bash curl "http://api.timezonedb.com/v1/get-time-zone?key=YOUR_API_KEY&by=zone&zone=Asia/Shanghai" ``` ### Technical Analysis The documented TimezoneDB command instructs users to place an API key in the query string of a request sent over unencrypted HTTP. Because HTTP provides neither transport confidentiality nor server authenticity, an attacker able to observe or modify network traffic can capture the API key, inspect the request, or tamper with the returned time information. Embedding the credential in the URL creates additional exposure risks because complete URLs may be retained in shell history, diagnostic output, HTTP proxy logs, and server access logs. The World Time API command is also sent over HTTP, allowing an on-path attacker to alter its response even though that particular request contains no credential. ### Attack Path 1. A user replaces `YOUR_API_KEY` with a valid TimezoneDB credential. 2. The user executes the documented `curl` command. 3. The request and API key travel over plaintext HTTP. 4. An attacker controlling or monitoring a network intermediary captures the request. 5. The attacker extracts and reuses the API key for unauthorized API requests. 6. Alternatively, the attacker modifies an HTTP response to provide false time data to a consuming script or application. ### Impact Assessment Successful exploitation does not directly grant local host privileges. It can expose the TimezoneDB account credential to unauthorized parties, permitting API use within the key's assigned quota and permissions. It may lead to quota exhaustion, service charges where applicable, service disruption, or inaccurate time-dependent application behavior. The scope is limited to users who ...[truncated 152 chars]
- Remediation
- ## Remediation Suggestions - Replace all plaintext HTTP API endpoints with supported HTTPS endpoints. - Avoid placing API credentials directly in command text or documentation examples. - Read credentials from a protected environment variable or secret manager. - Prefer an authorization header instead of a query parameter when the service supports it. - Ensure scripts do not enable shell tracing when handling credentials. - Warn users that URL query parameters may be recorded in shell history, proxy logs, and server logs. - Validate HTTPS certificates normally and do not recommend options such as `curl --insecure`. A safer pattern, subject to the provider's supported HTTPS interface, is: ```bash read -r -s TIMEZONEDB_API_KEY export TIMEZONEDB_API_KEY curl --fail --show-error --silent \ --get "https://api.timezonedb.com/v1/get-time-zone" \ --data-urlencode "key=${TIMEZONEDB_API_KEY}" \ --data-urlencode "by=zone" \ --data-urlencode "zone=Asia/Shanghai" unset TIMEZONEDB_API_KEY ``` If the provider supports header-based authentication, use that mechanism instead so the credential is not included in the URL.