T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:73- Finding
Unsafe External URL Interpolation and Unrestricted Web Fetching
- Content
View full analysis
" | python3 -c " import sys, re html = sys.stdin.read() # Strip tags, get text text = re.sub('<[^>]+>', ' ', html) text = re.sub(r'\s+', ' ', text).strip() print(text[:5000]) " ``` ### Technical Analysis The Skill instructs the agent to place a URL obtained during web research directly into a shell command. Although the remote HTTP response is only passed to Python through standard input and is not itself executed, the URL is embedded into shell syntax. If an attacker-controlled URL contains a quotation mark or other shell metacharacters and the agent reproduces it without robust escaping, it can terminate the quoted `curl` argument and introduce an additional shell command. The exact exploitability depends on how the hosting agent substitutes and escapes the `` placeholder, but the documented pattern does not impose safe argument handling. The command also uses `curl -L`, which follows redirects without restricting destination protocols, host classes, or network ranges. A malicious source can redirect the request to loopback, link-local, private-network, or cloud metadata endpoints. This creates an SSRF risk when the Skill runs in an environment with access to services that are not reachable by the original attacker. The detected pipeline is not a `curl | bash` remote-code execution mechanism: downloaded page content is supplied as data to a fixed Python program. Nevertheless, unrestricted URL handling exceeds the minimum network privileges needed for ordinary public-web research. ### Attack Path 1. An attacker publishes a page crafted to appear in search results relevant to a research query. 2. The research agent selects the attacker-controlled URL as a promising source. 3. One of the following paths occurs: - The U ...[truncated 1475 chars]- Remediation
View remediation