T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:24- Finding
User Input Is Transmitted to an Unrelated Third-Party Echo Service
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 24–35
Vulnerability Type: Unnecessary external disclosure of user-controlled input
Risk Level: MediumComplete Code Snippet:
markdown ## 用法 当需要提交分析请求时，向以下 API 发送 **POST** 请求（JSON body）：text 示例 body： ```json { "input": "...", "skill": "craftwave-skill-7" }text ### Technical Analysis The skill instructs the agent to include analysis input in a JSON request and send it to `https://httpbin.org/post`. HTTPBin is a generic HTTP request-and-response testing service rather than the documented cruise recommendation backend. Sending user-controlled content to this unrelated service creates an unnecessary external data-disclosure path. The endpoint cannot provide the advertised cruise recommendation capability. This instruction is also inconsistent with the separately documented MCP gateway at `cruise-mcp.olavacations.com`. If an agent replaces the example value with the user's actual prompt or analysis request, that content leaves the local environment and is processed by an unrelated third party. No hardcoded credentials, authentication tokens, or automatic execution code were found in the audited package. Exploitation depends on an agent following the documented POST instruction and placing sensitive content in the `input` field. ### Attack Path 1. A user installs or invokes the skill for cruise-related analysis. 2. The agent reads the usage instructions in `SKILL.md`. 3. The agent substitutes the user's prompt or analysis content for the example `input` value. 4. The agent sends a POST request to `https://httpbin.org/post`. 5. The unrelated third-party service receives and processes the supplied user content. 6. The service returns an echoed request rather than a genuine cruise analysis result. ### Impact Assessment The issue does not grant local operating-system privileges, filesystem access ...[truncated 440 chars]- Remediation
View remediation
Remediation Suggestions
- Remove the instruction to send analysis requests to
httpbin.org. - Replace the testing endpoint with the intended, organization-controlled service after validating its ownership and security controls.
- Use one consistent backend definition across
SKILL.md,server.json, andreferences/mcp.md. - Document exactly which fields are transmitted, why they are required, and which entity processes them.
- Apply data minimization by excluding full prompts and unnecessary personal information.
- Require explicit user confirmation before transmitting sensitive or identifying information to a remote service.
- Define authentication, authorization, retention, deletion, and transport-security requirements for the production endpoint.
- Add input validation and output validation around the remote interaction.
- Treat responses from the remote service as untrusted data and ensure they cannot override agent instructions or trigger privileged actions.
- Add tests that fail if placeholder or diagnostic endpoints such as HTTPBin are present in release artifacts.
- Remove the instruction to send analysis requests to