T09 · Insecure Skill Coding Practices
Warning
- Location
- scripts/fetch_boss.py:17
- Finding
- Unsanitized Remote Content Is Emitted into the Agent Context## Vulnerability Details **File Location**: `scripts/fetch_boss.py`, lines 17–26 and 64–65 **Vulnerability Type**: Improper validation of untrusted remote content **Risk Level**: Medium ### Vulnerable Code ```python def parse_boss_info(html): m = re.search(r'window\.d4WorldBoss=({[^}]+})', html) if not m: return None data = json.loads(m.group(1)) status = data.get("status", "") name = data.get("name", "") countdown_sec = data.get("time", 0) next_time = data.get("tsn", 0) ``` ```python lines.append(f"【当前BOSS】{info['name']}") lines.append(f"【状态】{info['status']}") ``` ### Technical Analysis The script parses JSON embedded in content downloaded from an external website. The remotely controlled `name` value and any unrecognized `status` value are inserted into output without character validation, length restrictions, control-character removal, or escaping. Known status values are mapped to fixed descriptions, but an unknown value is returned unchanged through: ```python status_desc = status_map.get(status, status) ``` The output is intended to be consumed within an AI Agent workflow. If the upstream endpoint or a destination reached through `curl -L` is compromised, an attacker could supply prompt-like text or terminal control characters in these fields. This content would then be presented as trusted Skill output. The script does not directly evaluate or execute the remote data, so this issue does not independently provide operating-system code execution. ### Attack Path 1. An attacker compromises `map.caimogu.cc`, influences its response, or controls a destination in its redirect chain. 2. The attacker returns a syntactically valid `window.d4WorldBoss` object containing crafted text in `name` or an unknown `status`. 3. `json.loads()` accepts the object, and the script extracts the attacker-controlled value without enforcing an allowlist or output-safe format. 4. The `output()` function inserts the value directly i ...[truncated 816 chars]
- Remediation
- ## Remediation Suggestions 1. Enforce a strict allowlist for `status` and replace unknown values with a fixed safe label rather than returning the remote value. 2. Validate `name` against the expected character set and impose a conservative maximum length. 3. Remove control characters, terminal escape sequences, and line breaks from all remotely sourced display fields. 4. Convert and range-check numeric fields before performing countdown arithmetic. 5. Explicitly mark fetched values as untrusted data when passing output into an Agent workflow. 6. Avoid unrestricted redirect handling. After retrieval, verify that the final URL uses HTTPS and that its hostname is exactly `map.caimogu.cc`. 7. Check the `curl` return code and HTTP failure status before parsing the response. 8. Add tests containing prompt-like strings, newlines, escape sequences, oversized values, unknown statuses, and malformed numeric fields.