T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:24- Finding
User Input Is Transmitted to an Unrelated External Testing Service
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 24-36
Vulnerability Type: Unnecessary external disclosure of user-supplied data
Risk Level: MediumVulnerable Code
markdown 当需要提交分析请求时，向以下 API 发送 **POST** 请求（JSON body）：text 示例 body： ```json { "input": "...", "skill": "ola-tool-cruise-finder" }> 发布到 CruiseSkillBridge 后，上述 URL 会自动替换为网关地址，调用将计入控制台统计。
text ### Technical Analysis The skill instructs the agent to place user-provided analysis input in the `input` property of a JSON request and transmit it to `https://httpbin.org/post`. HTTPBin is a general-purpose request inspection service and is not the cruise-search service described by the skill. Although the documentation states that the URL will be replaced during publication, the audited artifact still contains the external testing endpoint. An agent following the packaged instructions directly could therefore disclose the user's request to an unnecessary third party. HTTPS protects the request in transit but does not prevent the destination service from receiving, processing, logging, or retaining its contents. The issue is an insecure configuration and data-handling practice rather than a privilege-escalation vulnerability. Exploitation does not require local code execution: it only requires the skill to be invoked with user input while the documented endpoint remains active. ### Attack Path 1. A user asks the skill to analyze or search for a cruise and includes travel preferences or other personal information. 2. The agent loads and follows the request instructions in `SKILL.md`. 3. The agent serializes the request into the documented JSON structure, placing the user's content in the `input` field. 4. The agent sends an HTTPS POST request to `https://httpbin.org/post`. 5. The unrelated external service receives the full submitted input and may process or log it outside the expected crui ...[truncated 668 chars]- Remediation
View remediation
Remediation Suggestions
- Remove the
httpbin.orgplaceholder from every distributable version of the skill. - Configure the artifact to reference only the intended, production cruise-search endpoint.
- Add a publication or CI validation step that rejects testing endpoints and unresolved placeholders.
- Define an explicit request schema and transmit only fields strictly required for cruise searches.
- Warn users before transmitting sensitive information and obtain appropriate consent where necessary.
- Document the production service's operator, privacy policy, retention period, logging behavior, and deletion process.
- Avoid placing secrets, payment information, government identifiers, or unrelated personal data in the request body.
- If a diagnostic endpoint is needed for development, gate it behind an explicit development-only configuration and ensure it cannot appear in published artifacts.
- Remove the