T09 · Insecure Skill Coding Practices
- Location
SKILL.md:88- Finding
Unvalidated Worker Endpoint Enables Server-Side Request Forgery and Task Data Disclosure
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 88-108
Vulnerability Type: Server-Side Request Forgery through an untrusted A2A endpoint
Risk Level: HighVulnerable Code
bash curl -s -X POST {worker_a2a_url} \ -H "Content-Type: application/json" \ -d '{ "jsonrpc": "2.0", "id": 1, "method": "message/send", "params": { "message": { "role": "user", "parts": [{ "kind": "text", "text": "Please translate this to Japanese:\n\nHello, world. This is a test document." }] } } }'The same unsafe destination handling is repeated for structured requests beginning at
SKILL.md:117.Technical Analysis
The skill obtains
worker_a2a_urlfrom marketplace discovery results and uses it directly as the destination of acurlrequest. It does not require HTTPS, validate the hostname or port, resolve and inspect the destination IP address, or restrict requests to an approved set of ClawHire-controlled endpoints.Because the endpoint is supplied through external worker metadata, a malicious worker profile or compromised marketplace response could return a URL targeting:
- Loopback services such as
127.0.0.1or::1 - RFC 1918 private network services
- Link-local services or cloud instance metadata endpoints
- Internal administrative APIs
- An attacker-controlled server used to collect confidential task content
The request body contains the task instructions and may include documents, structured metadata, or other user-provided information. Consequently, this behavior combines an SSRF primitive with direct disclosure of task data.
Attack Path
- An attacker registers or controls a worker profile whose A2A URL points to an attacker-selected destination.
- The employer agent searches for workers through the ClawHire discovery service.
- The malicious profile is included in the di ...[truncated 1242 chars]
- Loopback services such as
- Remediation
View remediation
Remediation Suggestions
- Do not connect directly to arbitrary worker-supplied URLs. Prefer routing A2A traffic through a trusted ClawHire gateway that enforces destination policy.
- Require the
httpsscheme and reject URLs containing embedded credentials, fragments, unsupported ports, malformed hosts, or noncanonical IP representations. - Resolve the hostname before connecting and reject every resolved loopback, private, link-local, multicast, unspecified, documentation, and reserved IPv4 or IPv6 address.
- Pin the validated destination for the connection or use a trusted outbound proxy to prevent DNS rebinding between validation and connection.
- Restrict destination ports to an explicit allowlist, normally TCP 443.
- Keep redirects disabled. If redirect support is later introduced, validate every redirect target using the same scheme, hostname, port, and resolved-address controls.
- Apply outbound network controls at the container or host level so the skill cannot access cloud metadata, loopback services, or private network ranges.
- Display the validated destination and obtain explicit user approval before transmitting sensitive documents or task data to a third-party worker.
- Minimize transmitted data and redact credentials, secrets, personal information, and unrelated workspace content before constructing the A2A request.
- Record destination validation decisions and failures without logging confidential request bodies or authentication material.