T09 · Insecure Skill Coding Practices
- Location
references/schema-patterns.md:189- Finding
Unrestricted Remote OpenAPI Reference Retrieval
- Content
View full analysis
Vulnerability Details
File Location:
references/schema-patterns.md, lines 189–192
Vulnerability Type: Server-Side Request Forgery through unvalidated remote$refretrieval
Risk Level: MediumVulnerable Code:
markdown **External refs** (`$ref: './schemas/foo.yaml'` or `$ref: 'https://...'`): - Local file refs: read the referenced file from the same directory - Remote refs: fetch the URL if needed, or note it as an unresolvable external dependencyTechnical Analysis
The skill instructs the agent to fetch URLs supplied through remote OpenAPI
$refvalues. These values can be controlled by the author of an OpenAPI document, but the instructions impose no restrictions on URL schemes, destination hosts, resolved IP addresses, redirects, response sizes, or timeouts.Consequently, a crafted specification could direct an agent with network access to request loopback, private-network, link-local, cloud metadata, or other protected resources. Redirects and DNS rebinding could also bypass a superficial hostname check unless destinations are validated after every resolution and redirect.
Remote content is schema data rather than executable code, so the evidence does not establish remote code execution. The primary issue is unrestricted network access and potential SSRF-style resource retrieval.
Attack Path
- An attacker creates or modifies an OpenAPI document containing an external
$ref, such as a URL targeting an internal service or metadata endpoint. - The attacker persuades a user to ask the skill to parse the document or generate Drift tests from it.
- During recursive reference resolution, the agent follows the instruction to fetch the attacker-controlled URL.
- The request reaches a resource accessible from the agent's environment but potentially inaccessible to the attacker directly.
- Retrieved content may be exposed through generated analysis, error messages, or subsequent sc ...[truncated 660 chars]
- An attacker creates or modifies an OpenAPI document containing an external
- Remediation
View remediation
Remediation Suggestions
- Refuse remote
$refretrieval by default and require explicit user approval before any network request. - If remote retrieval is necessary, permit only HTTPS URLs hosted on an explicit allowlist.
- Reject URLs containing credentials and disallow non-HTTP schemes such as
file,ftp,gopher, and custom protocols. - Resolve hostnames before connecting and block loopback, private, link-local, multicast, reserved, and cloud metadata address ranges for both IPv4 and IPv6.
- Repeat destination validation after every DNS resolution and redirect; preferably disable redirects or restrict them to the original approved origin.
- Enforce strict connection and read timeouts, maximum redirect counts, maximum response sizes, and supported content types.
- Process downloaded content strictly as untrusted OpenAPI data and never as agent instructions or executable content.
- Record the final destination and retrieval decision so users can review network activity.
- Prefer requiring users to download and inspect external schemas separately, then provide them as local files within an approved project directory.
- Refuse remote