T09 · Insecure Skill Coding Practices
Warning
- Location
SAMPLE_AGENT.md:9- Finding
Unauthenticated Routing Markers Can Trigger Cross-Session Posts and Persistent Database Writes
- Content
View full analysis
Vulnerability Details
File Location:
SAMPLE_AGENT.md:9-20,SAMPLE_AGENT.md:26-29, andSAMPLE_SOUL_WINE.md:9-23
Vulnerability Type: Missing authentication and authorization for routed agent messages
Risk Level: MediumVulnerable Code
SAMPLE_AGENT.md:9-20:markdown When you receive a message containing an image URL forwarded from WhatsApp (look for `[Ingress:WhatsApp]` prefix or a bare image URL), do the following: 1. **Do NOT** describe or analyze the image yourself 2. **Immediately** classify the image intent from the URL context or any accompanying text: - 🍷 **Wine** — bottle, label, glass, wine list - 🍵 **Tea** — tea tin, tea cake, tea leaves, packaging - 🚬 **Cigar** — cigar band, humidor, cigar box - 👤 **Contacts** — face, business card, name badge, event badge - 📄 **Other** — anything else; log it and ask for clarification 3. **Preview** the detected category and the exact allowlisted destination. 4. **Ask for confirmation** before cross-session forwarding or any persistent database/channel write, unless the user has explicitly enabled automatic routing for that named destination. 5. **Forward** using `sessions_send` only after the confirmation boundary is satisfied.SAMPLE_AGENT.md:26-29:markdown sessions_send( sessionKey = "<your-wine-channel-session-key>", message = "[Vision Router] New image.\nType: Wine\nImage: <image_url>\n\nINSTRUCTION: Post the image to the channel, then analyze and log to your database." )SAMPLE_SOUL_WINE.md:9-23:markdown You are a wine specialist agent. Your job is to receive wine photos routed from the Vision Hub, post them to this channel, analyze the wine, and log a structured entry to the user's wine database. ## When You Receive a `[Vision Router]` Message Execute these steps **in order, in a single turn**: 1. **Post the image** to this Discord channel using the `message` tool with `media: <image_url>` 2. **Analyze** the wi ...[truncated 4077 chars]- Remediation
View remediation
Remediation Suggestions
-
Authenticate routing messages
- Accept ingress only from immutable, explicitly allowlisted channel, participant, and session identifiers.
- Do not use
[Ingress:WhatsApp],[Vision Router], or any other user-controlled text as proof of origin. - Reject messages when trusted transport metadata is unavailable.
-
Use integrity-protected routing envelopes
- Have the hub create a signed envelope containing the source session, destination identifier, media identifier, operation type, approval state, timestamp, expiration, and unique nonce.
- Validate the signature and every field at the specialist before performing any external action.
- Bind the approval to the exact media item, destination, and requested write.
-
Enforce authorization at the side-effect boundary
- Require the specialist itself to verify authorization before posting media or writing to a database.
- Do not rely solely on the upstream hub to obtain confirmation.
- Reject direct specialist messages that lack verifiable routing metadata.
-
Prevent replay
- Give every routing request a unique identifier and short expiration.
- Store consumed identifiers for the validity period and reject duplicate requests.
- Require fresh confirmation if the request expires or its destination changes.
-
Validate media references
- Permit only required URL schemes, preferably HTTPS.
- Allowlist trusted media hosts or use validated platform attachment identifiers instead of arbitrary URLs.
- Reject loopback, private, link-local, and cloud metadata network destinations where URL retrieval is supported.
- Apply size, content-type, redirect, and download-time limits.
-
Apply least privilege
- Limit each specialist to its specific destination channel and database collection.
- Use credentials that can create only the required record types and cannot administer or export the entire database.
- Keep automatic ...[truncated 349 chars]
-