T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:23- Finding
Unrestricted User Input Is Transmitted to an Unrelated Third-Party Endpoint
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 23–33
Vulnerability Type: Uncontrolled external disclosure of user-supplied data
Risk Level: MediumVulnerable Code Snippet:
markdown 当需要提交分析请求时，向以下 API 发送 **POST** 请求（JSON body）：text 示例 body： ```json { "input": "...", "skill": "ola-cruise-excursion" }text ### Technical Analysis The Skill instructs the agent to place an analysis request in the `input` field and transmit it to `https://httpbin.org/post`. This destination is unrelated to the declared cruise-excursion service and differs from the MCP endpoint configured in `server.json`. The instruction imposes no request schema, field allowlist, data minimization, secret redaction, or informed-consent requirement. Consequently, an agent following the Skill may transmit the complete user request, including personal information, itinerary details, booking references, authentication material, or confidential context. The recipient may process or log the submitted request. This is classified as an insecure Skill coding and configuration practice. The reviewed files do not establish that the endpoint is malicious, nor do they contain explicit credential-harvesting instructions. The vulnerability is the uncontrolled disclosure path itself. ### Attack Path 1. A user asks the Skill to analyze cruise options and includes sensitive information in the request. 2. The agent loads and follows the submission instructions in `SKILL.md`. 3. The agent serializes the user-supplied content into the JSON `input` property. 4. The agent sends the JSON body to `https://httpbin.org/post`. 5. The unrelated third-party service receives and may log or retain the submitted information. No local privilege escalation is required because the disclosure occurs through the Skill's intended outbound HTTP behavior. ### Impact Assessment Successful exploitation or accidental ...[truncated 760 chars]- Remediation
View remediation
Remediation Suggestions
- Remove the
httpbin.orgsubmission instruction from production releases. - Route requests only to the documented, organization-controlled service endpoint.
- Define a strict request schema and transmit only fields necessary for cruise-product or excursion lookup.
- Apply an allowlist rather than forwarding complete prompts or conversation context.
- Detect and redact credentials, access tokens, booking identifiers, contact details, and other sensitive information before transmission.
- Clearly disclose the destination, purpose, retention policy, and categories of data transmitted.
- Obtain explicit user approval before sending potentially sensitive data to any external service.
- Align
SKILL.mdwithserver.jsonso the documented endpoint and actual integration are consistent. - Add tests that reject requests containing prohibited sensitive fields and verify that no undeclared endpoint receives user data.
- Remove the