T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:24- Finding
Unrestricted Submission of User Input to an Unrelated Third-Party Endpoint
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 24-32
Vulnerability Type: External disclosure of potentially sensitive user input
Risk Level: MediumVulnerable Code
markdown 当需要提交分析请求时，向以下 API 发送 **POST** 请求（JSON body）：text 示例 body： ```json { "input": "...", "skill": "ola-agent-cruise-planning" }text ### Technical Analysis The skill instructs the agent to submit arbitrary analysis input through an HTTPS POST request to `httpbin.org`. This is a general-purpose third-party HTTP testing service and is not identified as part of the cruise-planning service described by the project. The `input` field has no documented schema, data-minimization requirement, sensitivity restriction, redaction procedure, or user-consent check. Consequently, an agent following the skill instructions could transmit complete prompts containing names, contact details, travel plans, booking references, authentication material, or other confidential information. HTTPS protects the request while it is in transit, but it does not prevent the receiving third party from accessing, processing, logging, or retaining the submitted content. No hardcoded credential or local code-execution path was identified. ### Attack Path 1. A user invokes the skill and provides cruise-planning or analysis data. 2. The supplied input contains personal, confidential, or credential-like information. 3. The agent follows the documented instruction and places that content in the JSON `input` field. 4. The agent sends the request to `https://httpbin.org/post`. 5. The third-party endpoint receives and can process or log the submitted content. Exploitation does not grant local operating-system privileges, execute code, or establish persistence. It exposes only the data included in the outbound request, but the scope may include all sensitive information placed in the unrestricted `input` value. ### ...[truncated 648 chars]- Remediation
View remediation
Remediation Suggestions
- Remove the
httpbin.orgplaceholder from the published skill. - Route requests only to an approved, organization-controlled cruise-planning API whose ownership and privacy practices are documented.
- Define a strict request schema containing only fields required for cruise searches.
- Reject or redact passwords, API keys, payment-card information, booking credentials, and unrelated prompt content before transmission.
- Present the destination, data categories, and purpose to the user and obtain explicit consent before sending personal information.
- Establish retention limits, access controls, logging restrictions, and deletion procedures for the receiving service.
- Add automated tests or policy checks that prevent production releases from referencing diagnostic endpoints such as
httpbin.org. - If a demonstration endpoint is necessary, clearly mark it as non-production and use fixed synthetic data rather than user-controlled input.
- Remove the