T09 · Insecure Skill Coding Practices
- Location
SKILL.md:9- Finding
Unvalidated External Resolver Can Receive Access Credentials and User-Supplied Content
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 9-16 and 34-47; related behavior is documented inreferences/dayuMiniPragram.md, lines 15-43 and 68-73
Vulnerability Type: Unvalidated transmission of credentials and user content to an externally configured service
Risk Level: MediumEvidence
markdown ## Default Target Use the configured resolver service by default. - Base URL: read from `MINIAPP_RESOLVER_BASE_URL` - Distribution key: read from `MINIAPP_DISTRIBUTION_KEY` - Health path: `/health` - Core endpoint: `POST /api/resolve` - Auth header: `X-Distribution-Key`The request workflow then sends the distribution key to the configured resolver:
bash curl -X POST "$MINIAPP_RESOLVER_BASE_URL/api/resolve" \ -H 'Content-Type: application/json' \ -H "X-Distribution-Key: $MINIAPP_DISTRIBUTION_KEY"Technical Analysis
The Skill instructs the agent to trust the resolver origin supplied through
MINIAPP_RESOLVER_BASE_URLand sendMINIAPP_DISTRIBUTION_KEYin an authentication header. It also directs callers to submit a copied media URL or complete share text in the request body. The reviewed files do not prescribe HTTPS enforcement, certificate requirements beyond platform defaults, an approved-host allowlist, destination confirmation, or validation that the configured origin belongs to the intended resolver operator.Consequently, configuration substitution, operator error, or compromise of the mechanism used to distribute the resolver URL can redirect requests to an attacker-controlled endpoint. That endpoint would receive both the distribution key and user-submitted content. Complete share text may contain private media URLs, tracking parameters, identifiers, or other contextual information beyond the minimum URL required for resolution.
The documentation also states that parsing activity is logged on the service, but it does not specify which fields are retained ...[truncated 1869 chars]
- Remediation
View remediation
Remediation Suggestions
- Restrict resolver communication to one or more explicitly approved HTTPS origins. Validate the parsed scheme, hostname, and effective port before transmitting credentials.
- Reject plaintext HTTP, URLs containing embedded credentials, unexpected ports, redirects to unapproved hosts, and malformed or non-network destinations.
- Display the effective destination and obtain explicit user approval before transmitting content when the endpoint is newly configured or has changed.
- Extract and submit only the minimum media URL required for resolution instead of complete share text. Remove unrelated text and unnecessary tracking parameters where compatible with resolver behavior.
- Use narrowly scoped, revocable keys with short expiration periods, strict platform permissions, and conservative request limits.
- Never expose distribution keys in logs, error messages, command history, diagnostics, or generated documentation. Redact authentication headers throughout the client and server logging paths.
- Define and publish the resolver's logging policy, including collected fields, retention duration, access controls, deletion procedures, and whether submitted URLs or share text are stored.
- Add automated tests confirming that non-HTTPS endpoints, unapproved hosts, and cross-origin redirects are rejected before the authentication header or request body is sent.
- Rotate the distribution key immediately whenever the configured endpoint is discovered to be incorrect or compromised.