Ucp Checkout Rest

• Outcome: Review
• Latest audit: Sep 16, 2026 · 8:17 AM UTC
• Version: 1.0.0

Overview

The skill is coherent checkout implementation guidance, but it tells implementers to fetch a client-provided profile URL without enough SSRF safeguards.

Review before installing or using this skill to generate production merchant-server code. If you use it, require strict validation for any UCP-Agent profile URL: prefer pre-registered trusted profile origins, reject private or metadata addresses, limit redirects, cap response sizes, set timeouts, and avoid exposing raw fetch errors or content.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:32

Finding

Unrestricted Retrieval of Client-Controlled Profile URI Enables SSRF

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 32 and 72
Vulnerability Type: Server-Side Request Forgery (SSRF) through an untrusted profile URI
Risk Level: Medium

Vulnerable code segments:

markdown

- `UCP-Agent`: Platform's profile URI in RFC 8941 structured field format — `profile="https://..."`

markdown

1. Parse `UCP-Agent` header and fetch platform profile for negotiation

Technical Analysis

The Skill directs a merchant server to extract a profile URI from the client-supplied UCP-Agent request header and fetch that URI during capability negotiation. It does not require validation of the destination beyond illustrating an HTTPS URI.

An implementation following these instructions may allow an unauthenticated remote client to control the destination of a server-side network request. The guidance omits essential SSRF protections, including:

• An allowlist of trusted profile origins
• Validation and normalization of the URI scheme, hostname, port, and user-information fields
• Rejection of loopback, private, link-local, multicast, reserved, and cloud-metadata addresses
• DNS-rebinding protection and validation of every resolved address
• Redirect restrictions and revalidation of redirect destinations
• Connection and response timeouts
• Response-size and content-type limits
• Safe parsing and isolation of retrieved profile data

Merely requiring HTTPS is insufficient because internal services may support HTTPS, attacker-controlled DNS can resolve to restricted addresses, and redirects can move an initially acceptable request to an internal destination.

Attack Path

1. An attacker sends a checkout request to the merchant endpoint.
2. The request contains a crafted UCP-Agent header whose profile value refers to an attacker-selected URL.
3. The merchant parses the header as instructed.
4. During capability negotiation, the merchant server fetches the s ...[truncated 1270 chars]

Remediation

View remediation

Remediation Suggestions

Replace unrestricted profile retrieval with a constrained and explicitly documented mechanism:

1. Prefer pre-registered platform profiles or an allowlist of trusted HTTPS origins.
2. Parse the URI with a standards-compliant parser and reject non-HTTPS schemes, embedded credentials, unexpected ports, malformed hosts, and ambiguous encodings.
3. Resolve the hostname before connecting and reject every address in loopback, private, link-local, multicast, reserved, and cloud-metadata ranges for both IPv4 and IPv6.
4. Pin the validated address for the connection or otherwise prevent DNS rebinding.
5. Disable redirects where possible. If redirects are necessary, impose a small hop limit and repeat all URI and resolved-address validation for every destination.
6. Apply strict connection, read, and total timeouts; cap response size; and accept only the expected profile content type and schema.
7. Use a dedicated outbound proxy or sandbox with network-level egress restrictions.
8. Do not return raw fetched content or sensitive connection errors to clients, and sanitize logs.
9. Cache validated profiles by trusted identity rather than repeatedly fetching arbitrary client-provided locations.
10. Add tests covering loopback, RFC1918, link-local, IPv6, encoded IP addresses, DNS rebinding, alternate ports, and redirect-based bypasses.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep