T09 · Insecure Skill Coding Practices
Warning
- Location
- scripts/arxiv_papers_search_scraper_api.py:21
- Finding
- Unrestricted Remote Browser Target Exceeds the Declared arXiv Scope<![CDATA[ ## Vulnerability Details **File Location**: `scripts/arxiv_papers_search_scraper_api.py:21-30, 113` **Vulnerability Type**: Unvalidated remote browsing destination **Risk Level**: Medium ### Vulnerable Code ```python def run_arxiv_papers_search_scraper_task(api_key, base_url='https://arxiv.org', keyword='large language model', search_type='all', count='20'): """ Starts a BrowserAct template task and polls for completion. Returns structured data as a string, or None on failure. """ headers = {"Authorization": f"Bearer {api_key}"} payload = { "input": { "base_url": base_url, "keyword": keyword, "search_type": search_type, "count": count, } } ``` The value is taken directly from a command-line argument: ```python base_url = sys.argv[1] if len(sys.argv) > 1 else 'https://arxiv.org' ``` ### Technical Analysis The Skill is expressly presented as an arXiv search integration, but it accepts an arbitrary `base_url` and forwards that value to a remote BrowserAct workflow without validating its scheme, hostname, port, credentials, or destination. Allowing arbitrary destinations is not necessary for the declared arXiv-only functionality. It expands the capability from searching a defined public source to directing a remote browser workflow toward attacker-selected resources. No checks ensure that the URL is exactly `https://arxiv.org` or another explicitly approved arXiv hostname. The actual network request from the local script remains directed to the fixed BrowserAct API endpoint. Therefore, this is not direct local SSRF. The risk arises because BrowserAct receives the untrusted URL and may cause its browser infrastructure to visit it. Whether private or internal destinations can be reached depends on BrowserAct's own network isolation and URL-validation controls. The other remotely supplied parameters are also not validated. In particular, `search_type` is not ...[truncated 1743 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Remove `base_url` from user-controlled input if the Skill is intended exclusively for arXiv. 2. Hardcode the target as `https://arxiv.org`, or enforce an exact allowlist of approved HTTPS arXiv hostnames. 3. Parse URLs with a standards-compliant URL parser and reject: - Non-HTTPS schemes. - Embedded usernames or passwords. - Alternate or unexpected ports. - IP literals and localhost destinations. - Hostnames outside the explicit allowlist. 4. Ensure the remote workflow does not follow redirects to non-allowlisted hosts. This protection should also be enforced by BrowserAct, because local validation cannot control remote redirect behavior. 5. Validate `search_type` against the documented values: `all`, `title`, `author`, `abstract`, `comments`, `journal_ref`, `paper_id`, `doi`, and `full_text`. 6. Parse `count` as an integer and apply a reasonable positive upper bound before submitting a paid remote task. 7. Reject invalid input before making any authenticated BrowserAct API request. ]]>