T09 · Insecure Skill Coding Practices
Warning
- Location
- index.js:2
- Finding
- Undisclosed External Transmission of User Search Queries## Vulnerability Details **File Location**: `index.js:2-6` **Vulnerability Type**: Hard-coded external endpoint and behavior-documentation mismatch **Risk Level**: Medium ### Vulnerable Code ```js const response = await fetch("https://your-n8n-webhook-url", { method: "POST", headers: { "Content-Type": "application/json" }, body: JSON.stringify({ query }) }); ``` The runtime behavior conflicts with the endpoint documented at `SKILL.md:20`: ```md 3. Use exec tool to POST to n8n webhook at http://localhost:5678/webhook/product-search ``` ### Technical Analysis The implementation serializes the complete user-controlled `query` and transmits it to the hard-coded HTTPS host `your-n8n-webhook-url`. This differs from the documented behavior, which states that requests are sent to a service on `localhost`. Consequently, users and operators may reasonably expect product-search information to remain within the local environment while the implementation attempts to send it to an external destination. If this hostname is replaced with or resolves to an attacker-controlled service during deployment, that service can collect every query submitted through the skill. The endpoint is not loaded from a validated configuration source, constrained by an allowlist, or disclosed accurately in the skill documentation. The implementation also does not inspect or minimize potentially sensitive information contained in a query before transmission. This finding does not establish remote code execution, credential theft, or deliberate malicious behavior. The exposed scope is limited to data supplied in the `query` parameter. ### Attack Path 1. An operator deploys the skill while relying on the documentation indicating that requests use a localhost webhook. 2. The hard-coded hostname is made resolvable or replaced with an endpoint controlled by an untrusted party. 3. A user invokes `search_products` with a product query that in ...[truncated 1086 chars]
- Remediation
- ## Remediation Suggestions 1. Replace the hard-coded placeholder with the intended local endpoint or an explicitly supplied deployment configuration: ```js const endpoint = process.env.PRODUCT_SEARCH_WEBHOOK_URL; if (!endpoint) { throw new Error("PRODUCT_SEARCH_WEBHOOK_URL is not configured"); } ``` 2. Validate the configured URL before use. Restrict its protocol, hostname, and port to an approved allowlist. If the service is intended to remain local, accept only loopback hosts such as `127.0.0.1` or `localhost`. 3. Keep the implementation and `SKILL.md` consistent. Clearly disclose when queries are transmitted to a third-party or remotely operated service. 4. Obtain appropriate user confirmation before sending queries externally, particularly when they may contain personal or confidential information. 5. Minimize transmitted data and reject or redact fields that are unnecessary for product search. 6. Define and validate the webhook response against a strict schema before returning it to the agent or presenting it to a user. 7. Apply request timeouts, response-size limits, and controlled error handling to reduce availability and resource-exhaustion risks. 8. Add automated tests that verify the destination against the documented endpoint policy and fail deployment when a placeholder hostname remains configured.