T09 · Insecure Skill Coding Practices
Warning
- Location
- scripts/crawlora.sh:48
- Finding
- Undocumented POST Requests Are Permitted on GET-Only Endpoints## Vulnerability Details **File Location**: `scripts/crawlora.sh`, lines 48-53 and 96-100 **Vulnerability Type**: Method allowlist exceeds the documented API capability **Risk Level**: Medium ### Vulnerable Code ```sh case "$method" in GET|POST) ;; *) echo "only GET and POST are supported by the macys-research skill" >&2 exit 2 ;; esac ``` ```sh else [ -n "$body" ] || body="${rest[0]:-}" [ -n "$body" ] || body='{}' # Stream the body on stdin so curl never interprets a user value as its # @file shorthand (and cannot read local files supplied in a request body). printf '%s' "$body" | curl -fsS -X "$method" "${auth[@]}" \ -H "Content-Type: application/json" --data-binary @- "${base}${path}" fi ``` ### Technical Analysis The endpoint catalog declares all three supported Macy's operations as `GET` endpoints. The helper nevertheless accepts `POST` and sends an arbitrary caller-controlled JSON body with the user's `CRAWLORA_API_KEY`. This creates a mismatch between the reviewed/documented capability and the executable capability. Although destination and top-level path validation remain constrained, the helper can attempt authenticated operations that the skill does not claim to support. Whether a particular request produces a side effect depends on the remote Crawlora API's handling of undocumented methods. ### Attack Path 1. An attacker influences a caller or agent to invoke the helper with `-X POST`. 2. The attacker chooses one of the paths accepted by the helper and supplies a controlled JSON body. 3. The script reads the victim's `CRAWLORA_API_KEY` from the environment. 4. The helper sends the body and API key to Crawlora using an authenticated POST request. 5. If the remote service supports undocumented POST behavior for the selected route, it processes the operation under the victim's API account. Example invocation: ```sh scripts/crawlora.sh -X POST /ma ...[truncated 606 chars]
- Remediation
- ## Remediation Suggestions Enforce the exact HTTP method declared for each route. Because every endpoint currently documented by this skill is GET-only, reject POST entirely: ```sh [ "$method" = "GET" ] || { echo "only GET is supported by the macys-research skill" >&2 exit 2 } ``` Remove the POST body-processing branch and update usage comments so they describe only this skill's supported operations. If POST endpoints are added later, implement an explicit route-to-method allowlist rather than a global method allowlist. Add negative tests confirming that `-X POST`, unsupported methods, and bodies supplied to GET-only routes are rejected before any network request occurs.