htaccess Generator

• Outcome: Pass
• Latest audit: Sep 12, 2026 · 1:02 AM UTC
• Version: 1.0.0

Overview

This skill is a coherent local .htaccess generator, but users should treat its inputs and output file path carefully because it performs little validation.

Install only if you are comfortable reviewing generated Apache configuration. Use trusted, simple values for domains, origins, IPs, paths, and rewrite expressions; avoid feeding user-controlled text into this tool; and be careful with --output because it may overwrite the named file.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/htaccess_gen.py:51
• Finding: Apache Configuration Injection Through Unsanitized CLI Arguments<![CDATA[ ## Vulnerability Details **File Location**: `scripts/htaccess_gen.py:51-53`, `scripts/htaccess_gen.py:98-102`, `scripts/htaccess_gen.py:106-112`, `scripts/htaccess_gen.py:115-121`, `scripts/htaccess_gen.py:124-126`, `scripts/htaccess_gen.py:133-139`, and `scripts/htaccess_gen.py:142-147` **Vulnerability Type**: Apache configuration injection **Risk Level**: High ### Vulnerable Code ```python # CORS if args.cors: origin = args.cors_origin or "*" parts.append(section("CORS Headers")) parts.append("<IfModule mod_headers.c>") parts.append(f' Header set Access-Control-Allow-Origin "{origin}"') ``` ```python # Hotlink protection if args.hotlink_protection: domain = args.domain or "example.com" parts.append(section("Hotlink Protection")) parts.append("RewriteEngine On") parts.append("RewriteCond %{HTTP_REFERER} !^$") parts.append(f"RewriteCond %{{HTTP_REFERER}} !^https?://(www\\.)?{domain.replace('.', '\\.')} [NC]") parts.append("RewriteRule \\.(jpg|jpeg|png|gif|webp|svg)$ - [F,NC]") ``` ```python # IP blocking if args.block_ip: parts.append(section("IP Blocking")) parts.append("<RequireAll>") parts.append(" Require all granted") for ip in args.block_ip: parts.append(f" Require not ip {ip}") parts.append("</RequireAll>") ``` ```python # Directory index if args.index: parts.append(section("Directory Index")) parts.append(f"DirectoryIndex {args.index}") ``` ```python def redirect(args): code = args.type or 301 parts = [] parts.append("RewriteEngine On") parts.append(f"RewriteRule ^{args.from_path.lstrip('/')}$ {args.to} [L,R={code}]") print("\n".join(parts)) ``` ```python def rewrite(args): parts = [] parts.append("RewriteEngine On") if args.condition: for cond in args.condition: parts.append(f"RewriteCond {cond}") flags = args.flags or "[L,QSA]" parts.append(f"RewriteRule {args.pattern} {args.target} {flags}") ...[truncated 3267 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Reject `\r`, `\n`, and NUL characters in every argument before generating configuration. 2. Validate each structured option according to its intended grammar: - Parse `--block-ip` values with Python's `ipaddress.ip_address()` or `ipaddress.ip_network()`. - Restrict redirect status codes to an explicit allowlist such as `301` and `302`. - Parse CORS origins as URLs and permit only expected schemes and host syntax. - Validate domains as canonical hostnames rather than arbitrary strings. - Restrict index names to safe relative filenames and reject whitespace or Apache metacharacters. 3. Constrain redirect source patterns and destinations to the documented path or URL formats. 4. For rewrite expressions, reject line breaks even when advanced regular expressions are allowed. 5. If raw Apache syntax must be supported, expose it through a clearly named unsafe or trusted-input mode and document that it must never receive untrusted data. 6. Add unit tests covering newline injection, quotation termination, invalid CIDR values, malformed origins, unsupported status codes, and invalid filenames. 7. Validate generated configuration with an isolated Apache syntax check before deployment. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/htaccess_gen.py:18
• Finding: Host Header Injection in Canonical Redirect Rules<![CDATA[ ## Vulnerability Details **File Location**: `scripts/htaccess_gen.py:18-38` **Vulnerability Type**: Host-header-based redirect poisoning **Risk Level**: Medium ### Vulnerable Code ```python # HTTPS redirect if args.https: parts.append(section("Force HTTPS")) parts.append("RewriteEngine On") parts.append("RewriteCond %{HTTPS} off") parts.append("RewriteRule ^ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]") # WWW / no-www if args.www: domain = args.domain or "example.com" parts.append(section("Force www")) parts.append("RewriteEngine On") parts.append(f"RewriteCond %{{HTTP_HOST}} !^www\\. [NC]") parts.append(f"RewriteRule ^ https://www.%{{HTTP_HOST}}%{{REQUEST_URI}} [L,R=301]") elif args.no_www: parts.append(section("Remove www")) parts.append("RewriteEngine On") parts.append("RewriteCond %{HTTP_HOST} ^www\\.(.*) [NC]") parts.append("RewriteRule ^ https://%1%{REQUEST_URI} [L,R=301]") ``` ### Technical Analysis The generated redirect targets are constructed from Apache's `%{HTTP_HOST}` value or a capture derived from it. `HTTP_HOST` originates from the client-controlled HTTP `Host` header. The generated rules do not verify that the host belongs to an expected allowlist before placing it in the `Location` response header. The `--www` branch assigns `args.domain` to `domain`, but the value is not used in the redirect. Consequently, even when the operator supplies a canonical domain, the generated rule continues to trust the request host. Whether exploitation succeeds depends on the surrounding Apache virtual-host configuration. A deployment that rejects unknown hosts can mitigate the issue. However, where the default virtual host accepts arbitrary hostnames, these rules can generate redirects to attacker-selected domains. ### Attack Path 1. The generated `.htaccess` file is deployed on an Apache virtual host that accepts requests with unrecognized `Host` headers. 2. An attacker sends a request wit ...[truncated 1066 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Require a validated canonical domain whenever `--https`, `--www`, or `--no-www` generates an absolute redirect. 2. Emit the validated literal domain in the redirect target instead of `%{HTTP_HOST}` or a host-derived capture. 3. Validate canonical domains against strict hostname syntax and reject schemes, ports unless explicitly supported, path characters, whitespace, and line breaks. 4. Add a host allowlist condition before redirecting, and reject unexpected hosts at the virtual-host level. 5. Configure Apache with explicit `ServerName` and `ServerAlias` values and ensure the default virtual host does not serve arbitrary hostnames. 6. Add tests that send unexpected `Host` values and verify that redirect locations always use the configured canonical domain. ]]>

SkillSpector

Vulnerability Patterns

• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 86% confidence
• Finding: The skill advertises or implies a file-writing capability via the documented `--output <file>` behavior, but it does not declare any tool scope such as `permissions` or `allowed-tools`. This creates a capability-transparency gap: an agent may write attacker-influenced content to arbitrary files without explicit permission boundaries, increasing the risk of unsafe file modification or overwrite in downstream automation.

Missing User Warnings

Low

• Confidence: 82% confidence
• Finding: The script writes generated content directly to the user-specified output path with `write_text()` and only reports success afterward. While the CLI argument names the output path, there is no confirmation prompt or cautionary message that this action will modify or replace an existing file.

Static analysis

No suspicious patterns detected.