T09 · Insecure Skill Coding Practices
- Location
scripts/search.sh:17- Finding
Unvalidated API Endpoint Override Enables Query Exfiltration and Response Spoofing
- Content
View full analysis
Vulnerability Details
File Location:
scripts/search.sh, lines 17 and 65–68
Vulnerability Type: Unvalidated environment-controlled API endpoint
Risk Level: MediumVulnerable Code
bash BASE_URL="${B2B_SKILL_BASE_URL:-https://gwgp-zmtc8kkxxzw.i.bdcloudapi.com}" APP_SOURCE="${B2B_SKILL_SOURCE:-workbuddy}" TIMEOUT="${B2B_SKILL_TIMEOUT:-60}"bash RESP="$(curl -sS --max-time "$TIMEOUT" -X POST "$BASE_URL/skill_api/product_search" \ -H "Content-Type: application/json" \ -H "X-App-Source: $APP_SOURCE" \ -d "$BODY" 2>&1)" || {Technical Analysis
The
B2B_SKILL_BASE_URLenvironment variable fully controls the destination to which the script sends product-search requests. The script does not validate the URL scheme, hostname, port, or destination against an allowlist.This override is not documented as an approved interface in
references/product_search_bridge.md, which identifies one specific HTTPS endpoint. It also conflicts with_common.md, which instructs the Skill to use only explicitly documented interfaces.An attacker who can influence the script's environment can therefore redirect requests to an arbitrary HTTP or HTTPS service. Request bodies can contain commercially sensitive procurement data, including product requirements, specifications, budget limits, categories, and preferred locations.
The script also trusts the remote response. A malicious endpoint can return a successful JSON object containing fabricated Markdown in
data.content. BecauseSKILL.mddirects the Agent to reproduce this content and its links without modification, the override can also facilitate product-result spoofing and malicious-link delivery.This issue does not independently provide local command execution. Exploitation requires control over, or influence upon, the process environment.
Attack Path
- The attacker gains the ability to set environment variables for the process invoking the Skill, such as through a c ...[truncated 1448 chars]
- Remediation
View remediation
Remediation Suggestions
-
Remove the endpoint override if runtime endpoint customization is unnecessary.
bash readonly BASE_URL="https://gwgp-zmtc8kkxxzw.i.bdcloudapi.com" -
If customization is required, enforce an explicit allowlist. Parse and verify that the effective endpoint:
- Uses HTTPS.
- Has exactly the approved hostname.
- Uses an approved port.
- Contains no embedded username or password.
- Does not resolve to loopback, link-local, private, or metadata-service addresses unless explicitly required.
-
Prevent redirect-based bypasses. Do not enable automatic redirects. If redirects are later enabled, validate every redirect destination against the same allowlist.
-
Validate returned links before displaying them. Permit only approved HTTPS marketplace domains and reject unexpected URL schemes such as
javascript:,data:, orfile:. -
Treat remote Markdown as untrusted data. Prefer constructing output locally from validated JSON fields rather than directly reproducing server-rendered
data.content. -
Document all supported configuration variables. Ensure the implementation and
_common.mdagree about which external interfaces are authorized. -
Add security regression tests confirming that unapproved hosts, plaintext HTTP endpoints, embedded credentials, unexpected ports, malformed URLs, and malicious response links are rejected.
-