T09 · Insecure Skill Coding Practices
Warning
- Location
- references/instructions.md:57
- Finding
- Unrestricted Fetching of User-Controlled URLs## Vulnerability Details **File Location**: `references/instructions.md:57` and `references/instructions.md:141`; network access is enabled by `claw.json:7` **Vulnerability Type**: Server-Side Request Forgery through unrestricted URL retrieval **Risk Level**: Medium **Vulnerable Code Snippets**: `references/instructions.md:57` ```markdown - Marketing copy text, a URL (fetch with WebFetch), or an image ``` `references/instructions.md:141` ```markdown - A URL to a privacy policy (fetch with WebFetch) or pasted text ``` `claw.json:7` ```json "permissions": ["network"], ``` ### Technical Analysis The Skill instructs the agent to retrieve URLs supplied by users and has the network permission required to do so. It does not impose scheme or destination restrictions, reject URLs containing credentials, prevent access to loopback/private/link-local networks, or require redirect destinations to be revalidated. This creates a potential server-side request forgery boundary violation. Depending on the behavior and network placement of the WebFetch implementation, an attacker may be able to induce requests to internal HTTP services, local administrative interfaces, or cloud instance metadata endpoints. If retrieved content is included or summarized in the compliance report, data from an otherwise inaccessible service could be disclosed. ### Attack Path 1. An attacker asks the Skill to audit a privacy policy or marketing page at an attacker-selected URL. 2. The supplied URL points directly to an internal destination or to an external endpoint that redirects to one. 3. The agent follows the instruction and invokes WebFetch using its network permission. 4. The fetch mechanism connects to a loopback, private, link-local, metadata, or other non-public service if the runtime does not independently block it. 5. The returned content enters the model context. 6. The Skill quotes, summarizes, or reasons over the retrieved con ...[truncated 922 chars]
- Remediation
- ## Remediation Suggestions 1. Accept only absolute `https://` URLs and reject all other schemes, including `http`, `file`, `ftp`, `gopher`, and `data`. 2. Reject URLs containing embedded credentials or ambiguous host representations. 3. Resolve the hostname before connecting and block loopback, private, link-local, multicast, reserved, and cloud metadata address ranges for both IPv4 and IPv6. 4. Re-resolve and revalidate the destination on every redirect; enforce a small redirect limit. 5. Prevent DNS rebinding by binding validation and connection to the same resolved address. 6. Consider an explicit allowlist of public domains appropriate to the compliance-review task. 7. Apply strict response-size, timeout, and content-type limits. 8. Do not reproduce secrets or sensitive fetched content in generated reports. 9. Update the instructions to state that only validated public HTTPS pages may be fetched. 10. Retain runtime egress controls even after adding instruction-level validation, because prompt instructions alone are not a security boundary.