T09 · Insecure Skill Coding Practices
Warning
- Location
- SKILL.md:74
- Finding
- Unvalidated Remote URL Download Enables SSRF and Unsafe File Write## Vulnerability Details **File Location**: `SKILL.md`, lines 74-80 **Vulnerability Type**: Unvalidated remote URL consumption and unsafe file download **Risk Level**: Medium ```bash URL=$(curl -s -X POST https://api.heybossai.com/v1/run \ -H "Authorization: Bearer $SKILLBOSS_API_KEY" \ -H "Content-Type: application/json" \ -d '{"model": "mm/img", "inputs": {"prompt": "A sunset over mountains"}}' \ | jq -r '.image_url // .result.image_url // .data[0]') curl -sL "$URL" -o sunset.png ``` ### Technical Analysis The URL returned by the external API is passed directly to `curl -L` without validating its scheme, hostname, resolved IP address, redirect destinations, content type, or response size. Quoting `"$URL"` prevents shell metacharacters from being interpreted as additional shell syntax, but it does not prevent server-side request forgery or malicious redirects. If the API, an upstream provider, or its response path is compromised, the returned URL could point to a loopback address, link-local service, private network host, or attacker-controlled endpoint. The `-L` option follows redirects without validating each destination. The response is then written to a predictable filename, `sunset.png`, without checking whether that file already exists. ### Attack Path 1. An attacker compromises or influences the API response used for image generation. 2. The response supplies an `image_url`, `result.image_url`, or `data[0]` value that references an internal address or redirects to one. 3. The documented command extracts that value and passes it directly to `curl -L`. 4. The Agent requests the attacker-selected resource from its own network context. 5. The resulting content is written to `sunset.png`, potentially replacing an existing file in the working directory. ### Impact Assessment Exploitation could cause the Agent to access services reachable only from its local or private network, including loopback, link ...[truncated 412 chars]
- Remediation
- ## Remediation Suggestions - Permit only `https` URLs. - Restrict downloads to an explicit allowlist of documented media-delivery domains. - Resolve the destination and reject loopback, link-local, private, multicast, and otherwise reserved IP ranges. - Disable redirects or validate the scheme, hostname, and resolved address of every redirect destination. - Apply connection, transfer, and overall timeouts. - Enforce maximum response sizes and verify the response content type before saving it. - Create output files safely with restrictive permissions and refuse to overwrite existing files unless the user explicitly approves. - Use a dedicated download directory and generate a unique filename rather than writing to a predictable path. - Treat all API-returned URLs as untrusted data, including URLs returned by upstream model providers.