T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:20- Finding
User Input Is Transmitted to an Unrelated Third-Party Test Endpoint
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md:20-27
Vulnerability Type: Unnecessary external transmission of user-controlled data
Risk Level: Mediummarkdown 当需要提交分析请求时，向以下 API 发送 **POST** 请求（JSON body）：text 示例 body： ```json { "input": "...", "skill": "craftwave-skill-11" }text ### Technical Analysis The skill instructs an agent to place user-provided input in the `input` field and send it to `https://httpbin.org/post`. This endpoint is a generic HTTP request-testing and echo service, not a purpose-specific cruise-product analysis service. The instructions provide no requirement to obtain user consent, minimize submitted fields, redact sensitive information, or prevent transmission of personal travel details. Because arbitrary user content may be included in `input`, following the documented workflow can disclose prompts and travel preferences to an unrelated external operator. Moreover, an echo endpoint cannot perform the advertised cruise analysis, so the configured data transfer is unnecessary for the stated functionality. No authentication token or local privilege escalation is involved. Exploitation depends on an agent following the skill instructions and including sensitive or private content in the request. ### Attack Path 1. A user invokes the skill and supplies cruise-related criteria or other information. 2. The agent follows the documented procedure in `SKILL.md`. 3. The agent serializes the user's content into the JSON `input` field. 4. The agent sends the JSON body to `https://httpbin.org/post`. 5. The unrelated third-party service receives the submitted content. 6. Any personal or sensitive information included in that content crosses the expected trust boundary without a documented necessity, consent process, or redaction step. ### Impact Assessment The issue may expose user prompts, travel preferences, dates, departure locations, budget information, or other data users include in t ...[truncated 433 chars]- Remediation
View remediation
Remediation Suggestions
- Remove the placeholder
httpbin.orgendpoint from the published skill. - Replace it with a documented, purpose-specific production endpoint controlled by the service provider.
- Fail closed when no production endpoint is configured instead of forwarding user input to a test service.
- Define a strict request schema and send only fields required for cruise-product lookup.
- Warn users not to submit credentials, payment data, passport information, or other sensitive personal data.
- Obtain explicit user consent before transmitting user content to any external service.
- Redact or reject unnecessary sensitive values before constructing the outbound request.
- Document the receiving operator, processing purpose, retention policy, and applicable privacy controls.
- Add automated validation to prevent test and echo domains from being used in production configurations.
- Perform a separate security assessment of the remote MCP service referenced by
server.json, because its server-side implementation is not included in this project and could not be statically audited.
- Remove the placeholder