T09 · Insecure Skill Coding Practices
Warning
- Location
- SKILL.md:11
- Finding
- Unrestricted Target Fetching Enables SSRF-Style Internal Network Access<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 11–13 and 30–31 **Vulnerability Type**: Server-Side Request Forgery (SSRF)-style unrestricted network access **Risk Level**: Medium ### Vulnerable Code ```yaml tools: - http - browser ``` ```markdown - Read-only pass: fetch `robots.txt`, the sitemap, and ~5 representative page headers (title, H1, meta description, canonical). ``` ### Technical Analysis The skill accepts a user-selected website as its audit target and directs the agent to fetch multiple resources from that target using the `http` and `browser` tools. It does not specify validation of the URL scheme, resolved IP address, hostname, port, redirects, or destination network. Consequently, a user may supply a loopback address, private-network address, link-local destination, cloud metadata endpoint, or a hostname that resolves to one of those destinations. The requests would originate from the agent's network environment rather than the user's environment. The documented “read-only” restriction prevents intentional modification of the target but does not mitigate unauthorized reading, internal service discovery, or disclosure of response content. ### Attack Path 1. An attacker requests an SEO audit of a destination such as a loopback host, RFC1918 address, link-local address, or attacker-controlled hostname that resolves to an internal address. 2. Following the skill instructions, the agent uses `http` or `browser` to request `robots.txt`, a sitemap, and representative pages. 3. If the agent can reach the destination, it receives responses from services that may not be externally accessible. 4. The skill incorporates discovered URLs, titles, headers, metadata, or crawlability details into its audit evidence. 5. The attacker obtains internal service information or content through the generated report. Redirects and DNS rebinding could also bypass a check performed only on the initial URL if the destination is not re ...[truncated 773 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Accept only explicitly formed `http://` or `https://` URLs; reject all other schemes, including `file`, `ftp`, `data`, and browser-specific schemes. 2. Resolve the hostname before each request and reject destinations in loopback, private, link-local, multicast, reserved, documentation, carrier-grade NAT, and cloud-metadata address ranges for both IPv4 and IPv6. 3. Re-resolve and revalidate the destination after every redirect. Reject redirects to a different origin unless the user explicitly approves the new public origin. 4. Defend against DNS rebinding by validating every resolved address and ensuring that the connection uses an approved resolution. 5. Block nonstandard ports unless they are explicitly required and approved. 6. Apply request timeouts, response-size limits, redirect limits, and a maximum number of fetched pages. 7. Add an explicit guardrail to `SKILL.md`, for example: ```markdown - Audit only public HTTP or HTTPS websites. - Never access loopback, private, link-local, reserved, or cloud metadata addresses. - Validate the resolved destination before every request and after every redirect. - Do not follow redirects to another origin without explicit user confirmation. ``` 8. Prefer enforcing these controls in the `http` and `browser` tool layer rather than relying solely on natural-language instructions. ]]>