T09 · Insecure Skill Coding Practices
- Location
SKILL.md:24- Finding
Unvalidated Authentication Destination May Expose Login Credentials
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 24 and 44–46; authentication flow at lines 150–156
Vulnerability Type: Unvalidated external URL used for authentication
Risk Level: HighVulnerable Code Snippet
markdown | `INSTACART_URL` | Yes | Base URL (e.g. `https://www.instacart.com` or `https://www.instacart.ca`) |markdown 1. **Read env vars first.** Read `.env.personal` (or your env file) to get `INSTACART_URL`, `INSTACART_EMAIL`, and `INSTACART_CODE_EMAIL` before opening the browser. 2. **Open Instacart and check login state.** Open `INSTACART_URL`, snapshot the page. If you see "Log in" or "Sign up" buttons, run the login flow (see Login Flow below).markdown 1. Open `INSTACART_URL` → get `targetId` 2. Snapshot → check for "Log in" button. If no login button, you're already logged in — done. 3. Click the "Log in" button 4. Type `INSTACART_EMAIL` into the email field with `--submit` 5. Fetch verification code via `gog` (see below) — this is one exec call 6. Snapshot → find the code input field 7. Type the 6-digit code into the verification field with `--submit` 8. Snapshot → confirm logged-in state (account menu visible)Technical Analysis
The authentication destination is controlled by the
INSTACART_URLenvironment variable. The instructions do not require validation of its scheme or hostname before entering the account email and six-digit verification code.Merely documenting legitimate example URLs does not enforce an allowlist. If an attacker can alter the environment file or variable, the agent can be directed to an attacker-controlled site that reproduces the expected “Log in” button and input fields. The workflow then instructs the agent to submit both the account email and a current one-time verification code to that site.
The destination should be treated as security-sensitive input. Validation must occur before opening it, after every navigation or redirect, and immediately before sub ...[truncated 1496 chars]
- Remediation
View remediation
Remediation Suggestions
- Enforce an exact allowlist of approved destinations, such as
www.instacart.comandwww.instacart.ca. - Require HTTPS and reject HTTP, user-information components, unexpected ports, deceptive subdomains, and hostnames that merely contain the word
instacart. - Parse the URL using a proper URL parser rather than substring or regular-expression matching.
- Validate the effective hostname after every redirect, navigation, or newly opened page.
- Revalidate the current page origin immediately before entering the email, verification code, payment information, address information, or other sensitive data.
- Stop the login flow and notify the user if the page leaves an approved origin.
- Prefer selecting a supported region from fixed configuration and deriving the base URL internally instead of accepting an arbitrary URL.
- Document trusted redirect hosts explicitly if legitimate authentication requires additional domains; do not allow arbitrary redirects.
- Protect the environment file with restrictive filesystem permissions and ensure less-trusted processes cannot modify it.
- Enforce an exact allowlist of approved destinations, such as