T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/discover-gateway.mjs:75- Finding
Arbitrary-Origin SSRF and Internal Service Reconnaissance
- Content
View full analysis
controller.abort(), timeoutMs); try { const response = await fetch(url, { method: 'GET', redirect: 'follow', signal: controller.signal, }); const text = await response.text(); return { path, url, status: response.status, ok: response.ok, durationMs: Date.now() - startedAt, contentType: response.headers.get('content-type'), body: text, }; ``` The arbitrary origin is subsequently used to probe a fixed collection of paths: ```js const paths = [ '/', '/health', '/openapi.json', '/openapi.full.json', '/mcp.json', '/skills/index.json', '/catalog', '/.well-known/agent.json', '/.well-known/agents.json', '/.well-known/x402', '/.well-known/mpp', '/llms.txt', '/skill.md', '/shop', '/shop/health', '/shop/openapi.json', '/shop/openapi.full.json', '/shop/llms.txt', '/shop/skill.md', '/shop/api/shop/items', '/shop/.well-known/agent.json', '/shop/.well-known/agents.json', '/shop/.well-known/x402', '/shop/.well-known/mpp', ]; ``` ### Technical Analysis The `--origin` validation only verifies that the parsed URL ...[truncated 2889 chars]- Remediation
View remediation