T09 · Insecure Skill Coding Practices
- Location
SKILL.md:65- Finding
Unvalidated Attachment URL Retrieval and Unsafe Temporary File Handling
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, line 65
Vulnerability Type: Server-Side Request Forgery, unsafe URL handling, and insecure temporary-file usage
Risk Level: MediumVulnerable Code
markdown 1. **Download image**: Extract the image URL from the Feishu message and use the `exec` command `curl -o /tmp/ocr_input.png "<image URL>"` to download itThe executable command specified by the Skill is:
bash curl -o /tmp/ocr_input.png "<image URL>"Technical Analysis
The Skill directs the Agent to insert an attachment URL into a shell-level
curloperation without specifying validation of:- The URL scheme
- The source hostname
- The resolved IP address
- Redirect destinations
- Response size
- Content type
- Whether the response is a valid image
Although enclosing the URL in double quotes reduces straightforward shell metacharacter injection, it does not make arbitrary URL retrieval safe. Depending on the installed
curlconfiguration and supported protocols, an attacker-controlled URL could reference internal HTTP services, loopback or link-local addresses, or non-HTTP resources such asfile://. Redirects can also be used to move a request from an initially permitted host to a prohibited internal destination if redirect validation is absent.The destination
/tmp/ocr_input.pngis a predictable, fixed path. In a shared environment, another process or local user could pre-create it as a symbolic link. Becausecurl -oopens the destination for writing, this may overwrite a file accessible to the Agent's operating-system identity. Concurrent OCR operations could also overwrite each other's files.Finally, the downloaded content is passed to ImageMagick and Tesseract later in the documented workflow. Missing size and format validation increases exposure to resource-exhaustion attacks and vulnerabilities in image-processing components.
Attack Path
- An attacker sends a Feishu message contain ...[truncated 1830 chars]
- Remediation
View remediation
Remediation Suggestions
-
Restrict attachment sources
- Accept only
https://URLs. - Allowlist the exact trusted Feishu attachment hostnames.
- Reject URLs containing user information, unexpected ports, or ambiguous host encodings.
- Accept only
-
Prevent SSRF
- Resolve the hostname before connecting.
- Reject loopback, private, link-local, multicast, reserved, and unspecified IP ranges for both IPv4 and IPv6.
- Revalidate every redirect destination or disable redirects entirely.
- Protect against DNS rebinding by binding validation to the actual connection address.
-
Constrain
curl- Use protocol restrictions, strict timeouts, and response-size limits.
- Example defensive baseline:
bash curl \ --fail \ --silent \ --show-error \ --proto '=https' \ --max-time 10 \ --connect-timeout 3 \ --max-filesize 10485760 \ --output "$secure_path" \ -- "$validated_url" - Do not enable unrestricted redirect following. If redirects are required, validate each destination.
-
Use secure temporary storage
- Create a private directory with
mktemp -d. - Set restrictive permissions such as
umask 077. - Generate unique filenames for every request.
- Refuse symbolic links and avoid fixed paths under shared
/tmp. - Register cleanup so files are removed on success, failure, interruption, and timeout.
- Create a private directory with
-
Validate downloaded content
- Enforce a small maximum file size before processing.
- Verify the MIME type and image signature rather than trusting the extension or response header.
- Decode the image with a constrained image library before invoking external processors.
- Reject unsupported formats and unreasonable dimensions.
-
Sandbox image processing
- Run ImageMagick and Tesseract with low privileges, resource limits, and no unnecessary network access.
- Keep both tools and their decoding libraries patched.
...[truncated 307 chars]
-