T09 · Insecure Skill Coding Practices
- Location
scripts/fetch_trending.py:171- Finding
Plaintext HTTP Retrieval Allows Tampering with arXiv Report Content
- Content
View full analysis
Vulnerability Details
File Location:
scripts/fetch_trending.py, lines 171–176
Vulnerability Type: Plaintext transport of untrusted external content
Risk Level: MediumVulnerable Code
python url = ( "http://export.arxiv.org/api/query" f"?search_query={urllib.parse.quote(query)}" f"&sortBy=submittedDate&sortOrder=descending" f"&max_results={max_results}" ) html = fetch_html(url)Technical Analysis
The arXiv API request begins over plaintext HTTP rather than HTTPS. HTTP provides neither server authentication nor transport integrity. An attacker with a network position—such as a compromised gateway, malicious Wi-Fi access point, or upstream proxy—could intercept and modify the XML response.
The script parses response fields including paper titles, summaries, authors, identifiers, and GitHub links, then stores them in
trending_report.json. The skill workflow subsequently directs the agent to read and interpret that report. Therefore, tampered source content can enter the final report as trusted-looking research metadata.Even if the server redirects HTTP requests to HTTPS, the initial request and redirect response remain vulnerable to interception. The attacker could prevent or replace the redirect.
The retrieved content is not directly passed to a shell or code interpreter, so this issue does not independently establish arbitrary code execution. Its primary effect is loss of report integrity, including the possibility of deceptive links and adversarial text reaching the interpreting agent.
Attack Path
- A user invokes the skill's preferred automated workflow.
fetch_arxiv_recent()requestshttp://export.arxiv.org/api/query.- A network-positioned attacker intercepts the plaintext request.
- The attacker returns modified XML containing fabricated titles, summaries, authors, identifiers, or repository links.
- The script parses the modified response and writes the attacker-controlled fields to ...[truncated 671 chars]
- Remediation
View remediation
Remediation Suggestions
- Replace the plaintext endpoint with the HTTPS endpoint:
python url = ( "https://export.arxiv.org/api/query" f"?search_query={urllib.parse.quote(query)}" f"&sortBy=submittedDate&sortOrder=descending" f"&max_results={max_results}" )-
Reject transport downgrades and validate that the final response URL remains HTTPS and belongs to the expected arXiv host.
-
Validate extracted links before including them in the report. Require HTTPS and allowlist expected hosts where practical, especially for arXiv identifiers and repository links.
-
Treat every fetched field as untrusted data. Ensure downstream instructions explicitly prohibit following commands or behavioral instructions embedded in titles, summaries, authors, or other source metadata.
-
Prefer a proper XML parser with secure parsing defaults over regular expressions, and apply reasonable response-size and field-length limits to reduce malformed-input and resource-exhaustion risks.