T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/get_transcript.sh:4- Finding
Unrestricted URL Passed to a Network-Capable Downloader
- Content
View full analysis
/dev/null 2>&1 ``` ### Technical Analysis The script only verifies that the URL argument is nonempty. It does not enforce the documented restriction to YouTube, validate the URL scheme or hostname, restrict ports, resolve and classify the destination address, or validate redirect destinations. The argument is correctly quoted, so this code does not expose direct shell command injection through ordinary metacharacters. However, quoting does not prevent network-level abuse. `yt-dlp` is network-capable and receives the attacker-controlled target directly, allowing it to initiate requests from the host running the skill. ### Attack Path 1. An attacker supplies a URL pointing to a non-YouTube destination, such as a loopback, link-local, private-network, or otherwise sensitive service. 2. The agent follows the documented workflow and invokes `get_transcript.sh` with that URL. 3. The script checks only whether the argument is empty and passes it to `yt-dlp`. 4. `yt-dlp` attempts to contact the supplied destination from the agent host. 5. Depending on network reachability and the target's response, the request may reveal service behavior or interact with resources unavailable to the attacker directly. Redirects and hostnames whose DNS results resolve to private addresses may provide additional paths around a hostname-only check. ### Impact Assessment Successful exploitation could cause network requests within the security contex ...[truncated 711 chars]- Remediation
View remediation