T09 · Insecure Skill Coding Practices
Warning
- Location
- SKILL.md:10
- Finding
- Insufficient URL Validation Allows Arbitrary Browser Navigation<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 10–12 and 26–27 **Vulnerability Type**: `T09: Insecure Skill Coding Practices` **Risk Level**: Medium ### Vulnerable Code ```markdown 1. Trigger on user messages in the form `recipe <url>`. 2. Validate URL format quickly. 3. Immediately acknowledge before extraction starts. ``` ```markdown 1. **Description/Caption first (highest signal)** - Open the URL in browser automation. ``` ### Technical Analysis The skill directs browser automation to open a user-controlled URL after only a vaguely defined, superficial URL-format check. It does not require an allowlist of supported video platforms or impose restrictions on URL schemes, destination ports, redirects, resolved IP addresses, or local and private network destinations. Because the browser executes from the agent's environment, it may have network access unavailable to the user. This creates an SSRF-like navigation risk in which a syntactically valid URL can target loopback services, private network hosts, link-local addresses, or cloud instance metadata services. Redirects from an initially acceptable public URL could produce the same outcome unless every redirect destination is validated. The skill's instruction to treat fetched content as untrusted mitigates prompt-injection risk, but it does not prevent unauthorized network requests or disclosure of content obtained from unintended destinations. ### Attack Path 1. An attacker sends a command such as `recipe <attacker-selected URL>`. 2. The URL passes the skill's generic format validation because no scheme, domain, IP-range, port, or redirect policy is specified. 3. Browser automation navigates to the supplied destination. 4. The destination resolves directly, or redirects, to a service reachable from the agent environment, such as a loopback, private-network, link-local, or metadata endpoint. 5. The skill captures the returned page text while attempting to identify a title, d ...[truncated 809 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Accept only `https` URLs and reject all other schemes, including `file`, `ftp`, `data`, and browser-specific schemes. 2. Maintain an explicit allowlist of supported video-platform hostnames rather than accepting arbitrary web destinations. 3. Parse URLs with a standards-compliant URL parser and reject embedded credentials, malformed hostnames, unsupported ports, and ambiguous numeric IP representations. 4. Resolve the destination before navigation and reject loopback, private, link-local, multicast, reserved, and cloud metadata address ranges for both IPv4 and IPv6. 5. Repeat destination validation after every DNS resolution and redirect; do not trust validation performed only on the original URL. 6. Apply the same destination controls to URLs discovered through `web_search` and opened through `web_fetch`. 7. Configure browser and fetch tools with outbound network restrictions so they cannot access local, private, or metadata networks. 8. Limit extracted response size and avoid returning raw content from pages that do not match an expected supported video platform. 9. Replace “Validate URL format quickly” with an explicit validation policy documenting permitted schemes, domains, redirects, ports, and IP ranges. ]]>