Htaccess Toolkit

• Outcome: Review
• Latest audit: Sep 16, 2026 · 5:58 AM UTC
• Version: 1.0.1

Overview

This appears to be a real .htaccess helper, but it can overwrite active web-server configuration and does not safely validate values inserted into generated rules.

Review generated .htaccess output before deploying it, avoid passing untrusted domain or redirect values, and avoid writing directly with -o .htaccess unless you have a backup and understand the server impact. The skill does not show malicious behavior, but its guardrails are weak for a tool that can modify web-server behavior.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/htaccess.py:210

Finding

Apache Configuration and Regular Expression Injection Through Unsanitized Generator Inputs

Content

View full analysis

Vulnerability Details

File Location: scripts/htaccess.py, lines 210–248
Vulnerability Type: Apache configuration injection and regular expression injection
Risk Level: High

Vulnerable Code

python

if args.cors:
    mode = args.cors
    if mode in CORS_RULES:
        rules = CORS_RULES[mode]
        if args.domain and mode == "specific":
            rules = [r.replace("{domain}", args.domain.replace(".", "\\.")) for r in rules]
        sections.append(rules)

if args.protect:
    for name in args.protect:
        if name in PROTECTION_RULES:
            rules = PROTECTION_RULES[name]
            if args.domain:
                rules = [r.replace("{domain}", args.domain.replace(".", "\\.")) for r in rules]
            sections.append(rules)
        else:
            print(f"Warning: Unknown protection '{name}'. Available: {', '.join(PROTECTION_RULES.keys())}", file=sys.stderr)

if args.redirects:
    redirect_lines = ["# Redirects"]
    for spec in args.redirects:
        parts = spec.split("->")
        if len(parts) == 2:
            from_path = parts[0].strip()
            to_url = parts[1].strip()
            status = "301"
            redirect_lines.append(f"Redirect {status} {from_path} {to_url}")
    sections.append(redirect_lines)

The resulting configuration is written at lines 261–263:

python

if args.output:
    with open(args.output, 'w') as f:
        f.write(output + "\n")

Technical Analysis

The --domain argument is inserted into Apache regular expressions after escaping only periods. Other regular-expression metacharacters, quotes, whitespace, carriage returns, and newline characters remain accepted. Consequently, an attacker-controlled domain can change the meaning of domain-specific CORS or hotlink-protection expressions. Control characters can also terminate the intended directive and introduce additional Apache configuratio ...[truncated 2103 chars]

Remediation

View remediation

Remediation Suggestions

1. Validate --domain as a canonical DNS hostname rather than treating it as an arbitrary regular-expression fragment:
   • Reject carriage returns, newlines, quotes, whitespace, slashes, and control characters.
   • Enforce valid hostname label and total-length limits.
   • Normalize internationalized domains to an explicitly supported ASCII representation if required.
2. Use re.escape() when inserting a validated hostname into an Apache regular expression instead of escaping only periods.
3. Validate redirect source paths:
   • Require a local absolute path beginning with /.
   • Reject whitespace, control characters, and Apache configuration delimiters.
4. Validate redirect destinations against an explicit policy:
   • Permit only local absolute paths or well-formed http and https URLs.
   • Optionally restrict external destinations to an allowlist.
   • Reject embedded credentials, control characters, and unsupported schemes.
5. Apply a final safety check to every generated line and reject any interpolated value containing \r, \n, or other non-printable characters.
6. Prefer structured generator functions that validate each semantic field before rendering configuration text.
7. Add tests covering newline injection, carriage-return injection, quotes, spaces, regex alternation, grouping, wildcards, malformed hostnames, unsupported URL schemes, and multiple -> delimiters.
8. Write to a temporary file, validate the complete generated configuration with Apache tooling where available, and replace the destination atomically only after successful validation.

SkillSpector

Vulnerability Patterns

• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 90% confidence

Finding

The skill advertises code-driven generation of .htaccess output, including writing directly to '.htaccess' via '-o .htaccess', but it does not declare any explicit tool scope such as 'permissions' or 'allowed-tools'. Undeclared file-write capability weakens sandboxing and review controls, increasing the risk that an agent could modify repository or server configuration files beyond what users expect.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

In the generate command, providing --output causes the tool to open the target path in write mode and replace its contents immediately. Although it prints a message after writing, there is no prior confirmation prompt, cautionary comment, or user-facing warning in this file about overwriting existing files.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.