T09 · Insecure Skill Coding Practices
- Location
references/link-handling-guide.md:22- Finding
Unrestricted Fetching of User-Supplied URLs Enables SSRF-Style Access
- Content
View full analysis
Vulnerability Details
File Location:
references/link-handling-guide.md:22-35
Vulnerability Type: Unvalidated external URL retrieval
Risk Level: MediumVulnerable Code
python # Try WebFetch first try: content = WebFetch(url) if content: extract_info(content) proceed_to_step_2() except: pass # Try browser automation if available try: content = BrowserOpen(url) if content:Related instructions in
SKILL.md:89-95direct the agent to access a user-provided link through WebFetch or browser automation without requiring URL validation.Technical Analysis
The workflow passes an attacker-controlled URL directly to network-capable tools. It does not validate the URL scheme, hostname, resolved IP address, port, redirect chain, or final destination.
If the underlying WebFetch or browser tool does not enforce equivalent restrictions, an attacker could supply a URL targeting:
- Loopback services such as
127.0.0.1orlocalhost - Private network addresses
- Link-local services or cloud instance metadata endpoints
- Public URLs that redirect to restricted network locations
- Unexpected schemes or nonstandard ports supported by the retrieval tool
Processing the resulting response with
extract_info(content)may expose information returned by an otherwise inaccessible service. The absence of redirect validation also permits a public-looking URL to redirect to a private destination after initial validation.Attack Path
- An attacker asks the skill to evaluate a tennis destination and includes a crafted URL.
- The URL points directly to an internal service or to an attacker-controlled public endpoint that redirects to one.
- The skill passes the URL to
WebFetch(url)orBrowserOpen(url). - The retrieval tool connects to the target if it lacks independent network isolation.
- The response is parsed as destination content.
...[truncated 648 chars]
- Loopback services such as
- Remediation
View remediation
Remediation Suggestions
- Accept only
httpsURLs unless another scheme is explicitly required. - Reject URLs containing embedded credentials, malformed hostnames, or unexpected ports.
- Resolve the hostname before access and reject loopback, private, link-local, multicast, reserved, and cloud-metadata address ranges for both IPv4 and IPv6.
- Revalidate DNS results immediately before connection to reduce DNS rebinding risk.
- Disable redirects or validate every redirect target using the same scheme, hostname, and IP-address controls.
- Prefer an allowlist of known public travel and social-media domains.
- Run retrieval in a network-isolated environment with no access to internal services or instance metadata.
- Treat retrieved pages as untrusted data and never follow instructions embedded in page content.
- Limit response size, content type, request duration, and the amount of fetched content included in the final response.
- Replace broad exception suppression with explicit error handling and security logging.
- Accept only