T09 · Insecure Skill Coding Practices
Warning
- Location
- scripts/search.sh:17
- Finding
- Unvalidated API Endpoint Override Enables Query Exfiltration and Response Spoofing## Vulnerability Details **File Location**: `scripts/search.sh`, lines 17 and 65–68 **Vulnerability Type**: Unvalidated environment-controlled API endpoint **Risk Level**: Medium ### Vulnerable Code ```bash BASE_URL="${B2B_SKILL_BASE_URL:-https://gwgp-zmtc8kkxxzw.i.bdcloudapi.com}" APP_SOURCE="${B2B_SKILL_SOURCE:-workbuddy}" TIMEOUT="${B2B_SKILL_TIMEOUT:-60}" ``` ```bash RESP="$(curl -sS --max-time "$TIMEOUT" -X POST "$BASE_URL/skill_api/product_search" \ -H "Content-Type: application/json" \ -H "X-App-Source: $APP_SOURCE" \ -d "$BODY" 2>&1)" || { ``` ### Technical Analysis The `B2B_SKILL_BASE_URL` environment variable fully controls the destination to which the script sends product-search requests. The script does not validate the URL scheme, hostname, port, or destination against an allowlist. This override is not documented as an approved interface in `references/product_search_bridge.md`, which identifies one specific HTTPS endpoint. It also conflicts with `_common.md`, which instructs the Skill to use only explicitly documented interfaces. An attacker who can influence the script's environment can therefore redirect requests to an arbitrary HTTP or HTTPS service. Request bodies can contain commercially sensitive procurement data, including product requirements, specifications, budget limits, categories, and preferred locations. The script also trusts the remote response. A malicious endpoint can return a successful JSON object containing fabricated Markdown in `data.content`. Because `SKILL.md` directs the Agent to reproduce this content and its links without modification, the override can also facilitate product-result spoofing and malicious-link delivery. This issue does not independently provide local command execution. Exploitation requires control over, or influence upon, the process environment. ### Attack Path 1. The attacker gains the ability to set environment variables for the process invoking the Skill, such as through a c ...[truncated 1448 chars]
- Remediation
- ## Remediation Suggestions 1. **Remove the endpoint override if runtime endpoint customization is unnecessary.** ```bash readonly BASE_URL="https://gwgp-zmtc8kkxxzw.i.bdcloudapi.com" ``` 2. **If customization is required, enforce an explicit allowlist.** Parse and verify that the effective endpoint: - Uses HTTPS. - Has exactly the approved hostname. - Uses an approved port. - Contains no embedded username or password. - Does not resolve to loopback, link-local, private, or metadata-service addresses unless explicitly required. 3. **Prevent redirect-based bypasses.** Do not enable automatic redirects. If redirects are later enabled, validate every redirect destination against the same allowlist. 4. **Validate returned links before displaying them.** Permit only approved HTTPS marketplace domains and reject unexpected URL schemes such as `javascript:`, `data:`, or `file:`. 5. **Treat remote Markdown as untrusted data.** Prefer constructing output locally from validated JSON fields rather than directly reproducing server-rendered `data.content`. 6. **Document all supported configuration variables.** Ensure the implementation and `_common.md` agree about which external interfaces are authorized. 7. **Add security regression tests** confirming that unapproved hosts, plaintext HTTP endpoints, embedded credentials, unexpected ports, malformed URLs, and malicious response links are rejected.