Static Server

• Outcome: Review
• Latest audit: Sep 11, 2026 · 4:47 AM UTC
• Version: 1.0.0

Overview

The skill is a simple static preview server, but it listens on all network interfaces and may expose the served directory beyond the local machine while it is running.

Install only if you are comfortable with the preview server exposing the selected file's parent directory or chosen directory to other machines that can reach your computer on that port. Prefer running it on trusted networks, serve a dedicated directory containing only preview files, and stop the server when testing is complete.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/serve.py:21

Finding

Static File Server Binds to All Network Interfaces

Content

View full analysis

Vulnerability Details

File Location: scripts/serve.py, lines 21–23
Vulnerability Type: Unrestricted network binding and unintended directory exposure
Risk Level: Medium

Vulnerable Code

python

os.chdir(directory)

Handler = http.server.SimpleHTTPRequestHandler

with socketserver.TCPServer(("", port), Handler) as httpd:

Technical Analysis

Passing an empty host string to socketserver.TCPServer causes the HTTP server to listen on all available network interfaces rather than only the loopback interface. This conflicts with the documented purpose of providing a localhost preview server.

The server uses SimpleHTTPRequestHandler after changing the working directory to the selected directory. Consequently, it serves the entire directory tree and can generate directory listings. When the supplied path is a file, the server still exposes that file's entire parent directory rather than restricting access to the requested file.

Attack Path

1. A user invokes the script with an HTML file or project directory.
2. The selected directory contains sibling files or subdirectories that were not intended for sharing.
3. The server binds to all interfaces through TCPServer(("", port), Handler).
4. A host with network access to the machine connects to the selected port.
5. The remote host requests the directory root or guesses/enumerates file paths.
6. SimpleHTTPRequestHandler returns accessible files or directory listings from the served tree.

Exploitation requires network reachability to the listening port while the server is running.

Impact Assessment

A reachable attacker may browse or download files under the served directory, including unintended sibling files and nested content. This can cause confidentiality loss within that directory tree. The flaw does not itself grant code execution, privilege escalation, persistence, or access beyond files readable by the account running the ...[truncated 8 chars]

Remediation

View remediation

Remediation Suggestions

1. Bind explicitly to the loopback interface:

   python

   with socketserver.TCPServer(("127.0.0.1", port), Handler) as httpd:
   

2. If IPv6 localhost support is required, provide an explicit and carefully tested loopback-only configuration rather than a wildcard bind.
3. Restrict requests to the specifically selected file when a file path is supplied, instead of serving its entire parent directory.
4. Disable directory listings by subclassing SimpleHTTPRequestHandler and rejecting directory-listing requests.
5. If public network access is a legitimate optional feature, require an explicit flag such as --bind, default it to 127.0.0.1, and display a clear warning when a non-loopback address is selected.
6. Document that all readable content beneath a served directory may otherwise be exposed, and recommend serving a dedicated directory containing only intended public files.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep