T09 · Insecure Skill Coding Practices
Error
- Location
SKILL.md:65- Finding
Unrestricted User-Controlled URL Fetching Enables SSRF
- Content
View full analysis
`) **Phase 1: Discovery (Sequential)** 1. Fetch homepage HTML (curl or WebFetch) 2. Detect business type (SaaS, Local, E-commerce, Publisher, Agency, Other) 3. Extract key pages from sitemap.xml or internal links (up to 50 pages) ``` The skill description additionally states: ```markdown "brand mentions", "GEO report", or any URL for analysis. ``` ### Technical Analysis The skill instructs the agent to fetch a user-supplied URL with `curl` or `WebFetch`, but it does not require any of the following controls: - Restriction to the `http` and `https` schemes. - Rejection of loopback, private, link-local, multicast, and reserved IP ranges. - DNS resolution checks to prevent DNS rebinding. - Validation of every redirect target. - Restrictions on nonstandard ports. - Response-size limits or strict redirect limits. - Separation between fetched content and generated reports. Because the accepted input is described as “any URL,” an attacker can provide a URL targeting a resource accessible from the agent's execution environment but not directly accessible to the attacker. Relevant targets may include localhost services, internal administrative interfaces, private network applications, container control endpoints, and cloud instance metadata services. The response is subsequently analyzed and may be included in generated audit output. This creates a potential channel for disclosing data returned by internal services. ### Attack Path 1. An attacker invokes a supported command with a crafted target, such as an address resolving to localhost, a private network, or a cloud metadata endpoint. 2. The skill follows its discovery wo ...[truncated 1317 chars]- Remediation
View remediation