T09 · Insecure Skill Coding Practices
Error
- Location
references/execute_tools.md:161- Finding
Unrestricted Authenticated HTTP Proxy Can Bypass Tool-Level Security Boundaries
- Content
View full analysis
Vulnerability Details
File Location:
references/execute_tools.md, lines 161–186 and 362–385
Vulnerability Type: Unrestricted authenticated HTTP proxying
Risk Level: HighVulnerable Code
markdown ## POST /tools/execute/proxy Bypass the gateway's tool execution layer and send a raw HTTP request to a third-party API using the connected account's credentials. ```bash curl.exe -X POST "https://api.aisa.one/apis/v1/composio/tools/execute/proxy" \ -H "Authorization: Bearer $env:AISA_API_KEY" \ -H "Content-Type: application/json" \ -d '{ "connected_account_id": "ca_xxxxxxxx", "endpoint": "https://api.github.com/user", "method": "GET" }'Request body fields:
Field Type Required Description endpointstring Yes Target API URL (absolute URL, or path relative to the connected account base URL) methodstring Yes HTTP method: GET,POST,PUT,PATCH,DELETEconnected_account_idstring Recommended Connected account ID for authentication. Uses project default if omitted bodyany No Request body (for POST/PUT/PATCH) parametersarray No Additional HTTP headers or query parameters binary_bodyobject No Binary upload body. URL form: {"url": "https://...", "content_type": "..."}; base64 form:{"base64": "..."}custom_connection_dataobject No Custom connection data, overrides the connected account's credentials text The same capability is also exposed inside Tool Router sessions: ```markdown ### POST /tool_router/session/{session_id}/proxy_execute — Proxy request within session ```bash curl.exe -X POST "https://api.aisa.one/apis/v1/composio/tool_router/session/{session_id}/proxy_execute" \ -H "Authorization: Bearer $env:AISA_API_KEY" \ -H "Content-Type: application/json" \ -d '{ "toolkit_slug": "github", "endpoint": "https://api.github.com/user", "met ...[truncated 3372 chars]- Remediation
View remediation
Remediation Suggestions
- Remove arbitrary proxy execution from the default Skill workflow and prefer schema-bound tools.
- Require an explicit connected account; never silently use a project default.
- Restrict absolute destinations to a maintained allowlist of official HTTPS origins associated with the selected toolkit.
- Resolve and validate hostnames before requests, rejecting loopback, private, link-local, multicast, and cloud metadata addresses.
- Revalidate every redirect and prohibit redirects to a different origin.
- Reject user-supplied
Authorization,Cookie, proxy, forwarding, and other credential-bearing headers. - Disable
custom_connection_dataand remote-URL binary uploads unless the user explicitly requests them and understands the exposure. - Require a dedicated confirmation immediately before every proxy request. The confirmation should display the account, destination origin, method, path, headers, and a redacted body summary.
- Apply separate read and write permissions. Deny
POST,PUT,PATCH, andDELETEunless expressly authorized for the specific operation. - Add request-size limits, audit logging, secret redaction, rate limits, and anomaly detection.
- Document all gateway-side destination controls so users can assess whether SSRF and cross-origin credential forwarding are prevented.