T09 · Insecure Skill Coding Practices
- Location
references/url-fallback.md:8- Finding
Unvalidated Remote Service Discovery Leaks Identity Codes and User URLs
- Content
View full analysis
Vulnerability Details
File Location:
references/url-fallback.md, lines 8–21
Vulnerability Type: Unvalidated remote endpoint discovery and server-side request forgery
Risk Level: HighVulnerable Code
bash curl -sL "https://api.skillhub.cn/api/v1/download?slug=duanshipinjiexi" -o "$TEMP_DIR/skill.zip" unzip -o "$TEMP_DIR/skill.zip" SKILL.md -d "$TEMP_DIR" 2>/dev/null NEW_URL=$(grep 'Base URL:' "$TEMP_DIR/SKILL.md" | sed 's/.*`\(.*\)`.*/\1/') rm -rf "$TEMP_DIR" if [ -n "$NEW_URL" ]; then curl -s --max-time 30 "$NEW_URL/api/parse.php?code={CODE}&url=视频链接" echo "【提示】解析服务地址已更新，后续使用新地址 $NEW_URL" else JSON=$(curl -s "https://clawhub.ai/api/v1/skills/duanshipinjiexi") NEW_URL=$(echo "$JSON" | python3 -c "import sys,json; d=json.load(sys.stdin).get('description',''); import re; m=re.search(r'Base URL: `(.+)`', d); print(m.group(1) if m else '')" 2>/dev/null) if [ -n "$NEW_URL" ]; then curl -s --max-time 30 "$NEW_URL/api/parse.php?code={CODE}&url=视频链接"Technical Analysis
When the primary parsing service fails, the fallback retrieves mutable metadata from SkillHub or ClawHub, extracts an arbitrary
Base URL, and immediately sends a request to that endpoint. The value is only checked for being nonempty. There is no structured URL parsing, HTTPS requirement, hostname or port allowlist, signature verification, redirect validation, or user confirmation.The resulting request contains both the persistent identity code and the user-supplied video URL in its query string. If either remote metadata source, package publication account, API response, or delivery path is compromised, an attacker can substitute an attacker-controlled URL and collect those values.
Because curl is invoked against an unrestricted destination from the Agent environment, a malicious URL may also direct requests toward loopback, link-local, private-network, or cloud metadata endpoints. Whether such requests produce useful responses depends on the runtime ...[truncated 2566 chars]
- Remediation
View remediation
Remediation Suggestions
- Remove dynamic endpoint discovery and keep the parser endpoint fixed wherever operationally possible.
- If failover is essential, use a hardcoded, version-controlled allowlist of exact HTTPS hostnames rather than extracting arbitrary URLs from mutable descriptions or packages.
- Parse candidate URLs with a proper URL parser and reject them unless all of the following hold:
- The scheme is exactly
https. - The hostname exactly matches an approved hostname.
- The port is absent or explicitly approved.
- No username, password, fragment, or unexpected path is present.
- The scheme is exactly
- Resolve the hostname and reject loopback, link-local, private, reserved, multicast, and cloud metadata address ranges. Repeat this validation after DNS resolution and before each connection to reduce DNS-rebinding risk.
- Disable redirects for requests carrying identity codes and user links. If redirects are operationally required, validate every redirect destination under the same policy.
- Authenticate failover metadata using a pinned signing key. Verify a signed manifest containing the endpoint, version, and expiration time before trusting it; a downloaded package alone is not a trust guarantee.
- Require explicit user confirmation before changing service operators or sending their link and identity code to a newly discovered host.
- Prefer request bodies over query strings for sensitive values so they are less likely to appear in intermediary logs. This does not replace endpoint validation.
- Avoid echoing untrusted endpoint values into user-visible output unless they are safely encoded.
- On validation failure, stop and instruct the user to update the Skill manually instead of contacting the candidate endpoint.