T09 · Insecure Skill Coding Practices
Warning
- Location
- SKILL.md:73
- Finding
- Unsafe External URL Interpolation and Unrestricted Web Fetching<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 73-80 **Vulnerability Type**: Command injection and server-side request forgery (SSRF) risk **Risk Level**: Medium ### Vulnerable Code ```bash curl -sL "<url>" | python3 -c " import sys, re html = sys.stdin.read() # Strip tags, get text text = re.sub('<[^>]+>', ' ', html) text = re.sub(r'\s+', ' ', text).strip() print(text[:5000]) " ``` ### Technical Analysis The Skill instructs the agent to place a URL obtained during web research directly into a shell command. Although the remote HTTP response is only passed to Python through standard input and is not itself executed, the URL is embedded into shell syntax. If an attacker-controlled URL contains a quotation mark or other shell metacharacters and the agent reproduces it without robust escaping, it can terminate the quoted `curl` argument and introduce an additional shell command. The exact exploitability depends on how the hosting agent substitutes and escapes the `<url>` placeholder, but the documented pattern does not impose safe argument handling. The command also uses `curl -L`, which follows redirects without restricting destination protocols, host classes, or network ranges. A malicious source can redirect the request to loopback, link-local, private-network, or cloud metadata endpoints. This creates an SSRF risk when the Skill runs in an environment with access to services that are not reachable by the original attacker. The detected pipeline is not a `curl | bash` remote-code execution mechanism: downloaded page content is supplied as data to a fixed Python program. Nevertheless, unrestricted URL handling exceeds the minimum network privileges needed for ordinary public-web research. ### Attack Path 1. An attacker publishes a page crafted to appear in search results relevant to a research query. 2. The research agent selects the attacker-controlled URL as a promising source. 3. One of the following paths occurs: - The U ...[truncated 1475 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Do not construct shell commands by interpolating URLs into command strings. 2. Use a dedicated HTTP library or invoke `curl` through an argument-array API that bypasses shell parsing. 3. Parse and normalize each URL before fetching it, and permit only `http` and `https` schemes. 4. Reject URLs containing embedded credentials, malformed hostnames, control characters, or unexpected syntax. 5. Resolve the destination hostname and block loopback, private, link-local, multicast, reserved, and cloud metadata address ranges for both IPv4 and IPv6. 6. Validate every redirect target independently rather than trusting the original URL validation. 7. Disable non-HTTP redirect protocols and impose strict redirect-count, connection-timeout, total-time, and response-size limits. 8. Run page retrieval in a sandbox with minimal filesystem access, no unnecessary credentials, and restricted outbound network access. 9. Replace the documented shell example with a safe helper program that accepts the URL as a discrete argument and applies the preceding controls. ]]>