T09 · Insecure Skill Coding Practices
- Location
SKILL.md:112- Finding
Unrestricted Fetching of User-Supplied URLs
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 112–120 and 141–142
Vulnerability Type: Server-Side Request Forgery (SSRF) through unrestricted URL fetching
Risk Level: MediumVulnerable Code:
markdown ## URL Handling When the user provides URLs in their note content: 1. **Attempt title extraction**: Try to fetch the page with WebFetch and extract the `<title>` tag. 2. **On success**: Write the extracted title next to the link, e.g.: `[页面标题](URL)` 3. **On failure** (internal pages, login walls, timeouts): Keep the link as-is along with whatever description the user provided. Do NOT retry or over-engineer. 4. **Self-contained note**: Each URL entry should include enough context for the user to understand what the link is about later, without relying on the page being accessible.markdown 6. **Handle URLs**: For any URLs in the content, try WebFetch to extract the page title. If it fails silently, keep the link + description.Technical Analysis
The skill directs the agent to pass every URL found in user-supplied note content to
WebFetch. It does not restrict URL schemes or destinations, validate resolved IP addresses, control redirects, or prohibit requests to loopback, private, link-local, reserved, or cloud metadata addresses. Its explicit reference to failures involving “internal pages” indicates that attempts to reach internal resources are anticipated rather than blocked.This creates an SSRF-style request primitive in environments where
WebFetchcan access destinations unavailable to the user. An attacker could submit a direct internal URL or use an external URL that redirects to an internal destination. DNS rebinding may also bypass validation if destination checks are not repeated when the connection is established.The fetched page title is incorporated into the note on success. Consequently, response data present in an internal page's
<title>element could be disclosed throu ...[truncated 1973 chars]- Remediation
View remediation
Remediation Suggestions
- Do not fetch URLs automatically. Require explicit confirmation before retrieving a page title, or leave URLs unchanged by default.
- Permit only normalized
httpsURLs. Reject non-HTTP schemes, embedded credentials, malformed URLs, ambiguous numeric IP representations, and protocol-relative URLs. - Resolve the hostname before making a request and reject every address in loopback, private, link-local, multicast, unspecified, documentation, carrier-grade NAT, and other reserved ranges for both IPv4 and IPv6.
- Pin the validated address during connection establishment to mitigate DNS rebinding and verify that the connected address matches an approved resolution result.
- Disable redirects or validate the scheme, hostname, resolved addresses, and connected address again at every redirect hop. Enforce a small redirect limit.
- Block cloud metadata hosts and addresses explicitly, including link-local metadata endpoints and provider-specific aliases.
- Apply strict connection and response timeouts, response-size limits, content-type restrictions, and download limits. Retrieve only the minimum content required to identify a title.
- Run fetching in a sandbox with no access to loopback or private networks and with restrictive outbound firewall rules.
- Treat extracted titles as untrusted text and safely encode them before inserting them into Markdown.
- If any destination cannot be validated conclusively, skip title extraction and preserve the original URL verbatim.