T09 · Insecure Skill Coding Practices
Warning
- Location
- scripts/crawlora.sh:34
- Finding
- Undocumented POST support permits arbitrary data transmission to the external API<![CDATA[ ## Vulnerability Details **File Location**: `scripts/crawlora.sh`, lines 34-38, 45-52, and 85-103 **Vulnerability Type**: Excessive network capability and insufficient request-method restriction **Risk Level**: Medium ### Vulnerable Code ```sh while [ $# -gt 0 ]; do case "$1" in -X) method="$2"; shift 2 ;; -d) body="$2"; shift 2 ;; *) args+=("$1"); shift ;; esac done ``` ```sh case "$method" in GET|POST) ;; *) echo "only GET and POST are supported by the oldnavy-research skill" >&2 exit 2 ;; esac ``` ```sh if [ "$method" = "GET" ]; then # -G + --data-urlencode URL-encodes each value (so spaces etc. are safe). qs=() for kv in ${rest[@]+"${rest[@]}"}; do [ -n "$kv" ] || continue # curl treats both @file and name@file forms as local-file input for # --data-urlencode. Reject @ outright so query arguments cannot disclose # local files to the Crawlora API. case "$kv" in *@*) echo "@ is not allowed in query arguments" >&2; exit 2 ;; esac qs+=(--data-urlencode "$kv") done curl -fsS -G "${auth[@]}" ${qs[@]+"${qs[@]}"} "${base}${path}" else [ -n "$body" ] || body="${rest[0]:-}" [ -n "$body" ] || body='{}' # Stream the body on stdin so curl never interprets a user value as its # @file shorthand (and cannot read local files supplied in a request body). printf '%s' "$body" | curl -fsS -X "$method" "${auth[@]}" \ -H "Content-Type: application/json" --data-binary @- "${base}${path}" fi ``` ### Technical Analysis All seven endpoints documented in `reference/endpoints.md` use HTTP GET. Nevertheless, the helper accepts `-X POST` and `-d`, then forwards an arbitrary caller-controlled body to the fixed Crawlora API origin. This capability is not required for the skill's declared product-search, category, review, store-location, or availability operations. It therefore exceeds the minimum network privileges necessary for the documented functionality. The script does not vali ...[truncated 2763 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Remove POST and request-body support because every documented endpoint is GET-only: ```sh case "$method" in GET) ;; *) echo "only GET is supported by the oldnavy-research skill" >&2 exit 2 ;; esac ``` 2. Remove parsing for `-d`, the `body` variable, and the POST branch so arbitrary payloads cannot be forwarded. 3. Prefer eliminating `-X` entirely and always invoke curl with GET semantics. 4. Validate query parameter names separately for each allowlisted endpoint. Reject unknown fields and enforce expected types and ranges for `brand`, `cid`, `pid`, `page`, `zip`, `lat`, `lng`, `store_id`, and `search`. 5. Avoid placing sensitive user content into product-search or location parameters unless it is strictly required and the user has knowingly requested the external lookup. 6. If POST endpoints are added later, maintain an explicit method-to-path allowlist and a strict body schema for each endpoint rather than enabling POST globally. 7. Document that search terms, ZIP codes, and coordinates are transmitted to Crawlora before requesting location-related data. ]]>