other
Warning
- Location
- SKILL.md:35
- Finding
- Third-Party Disclosure and Caching of Sensitive URLs and Retrieved Content<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 21, 35-36, 125-126, and 137 **Vulnerability Type**: Sensitive URL and content disclosure to a third-party service **Risk Level**: Medium ### Complete Code Snippets ```markdown Use StripFeed whenever you need to read a web page, article, documentation, or any URL content. It produces much cleaner output than raw HTML fetching and tells you the token cost. ``` ```bash curl -s "https://www.stripfeed.dev/api/v1/fetch?url=URL_HERE" \ -H "Authorization: Bearer $STRIPFEED_API_KEY" ``` ```bash curl -s -X POST "https://www.stripfeed.dev/api/v1/batch" \ -H "Authorization: Bearer $STRIPFEED_API_KEY" \ -H "Content-Type: application/json" \ -d '{"urls": ["https://example.com", "https://example.org"]}' ``` ```markdown - Responses are cached for 1 hour by default. Use `cache=false` for real-time content. ``` ### Technical Analysis The Skill instructs the agent to submit arbitrary user-provided URLs to `https://www.stripfeed.dev`. StripFeed then retrieves the referenced resources, transforms their contents, and caches responses for one hour by default. This remote processing is necessary for the Skill's declared URL-conversion functionality, and transmitting `STRIPFEED_API_KEY` to its designated service is expected authentication behavior. However, the instruction to use the service for “any URL content” lacks controls or warnings for sensitive inputs. A complete URL can itself contain confidential information, including: - Signed download links and temporary access tokens - Credentials embedded in URL authority components - Session identifiers or API keys in query strings - Private document identifiers - Internal hostnames, ports, paths, and network topology details The third-party service also receives the content fetched from the destination and may retain it through the documented cache. The Skill does not require user consent before this disclosure, distinguish public resources from ...[truncated 2307 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Restrict the documented scope to public, non-sensitive HTTP and HTTPS resources. 2. Require explicit user confirmation before submitting URLs or content to a third-party processing service. 3. Reject URLs containing embedded usernames or passwords and warn about secrets, session identifiers, signed tokens, and sensitive query parameters. 4. Block localhost, loopback, private, link-local, metadata-service, and other reserved network destinations, including equivalent IPv6 ranges and redirect targets. 5. Properly percent-encode the target URL as a query-parameter value instead of relying on direct textual substitution. 6. Make `cache=false` the recommended default for sensitive or time-limited resources and clearly document the service's caching, logging, retention, and deletion policies. 7. Prefer direct local retrieval and local content conversion when confidentiality is more important than the remote service's formatting features. 8. Minimize batch submissions because they disclose multiple browsing targets in one request. 9. Add clear documentation that the API key must only be sent to the canonical StripFeed HTTPS origin and must never be included in target URLs, logs, or diagnostic output. 10. Validate every redirect destination under the same URL policy before allowing retrieval. ]]>