T09 · Insecure Skill Coding Practices
Warning
- Location
fetch_url.py:8- Finding
Unrestricted URL Fetching Permits SSRF and Local Resource Access
- Content
View full analysis
") sys.exit(1) url = sys.argv[1] headers = {'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36'} req = urllib.request.Request(url, headers=headers) resp = urllib.request.urlopen(req, timeout=10) content = resp.read().decode('utf-8', errors='ignore') print(content) ``` ### Technical Analysis The script passes an arbitrary command-line argument directly to `urllib.request.Request` and `urllib.request.urlopen` without validating the URL scheme, destination hostname, resolved IP address, port, or redirect target. Although `SKILL.md` recommends public news websites, the executable interface does not enforce those restrictions. An attacker who can influence the URL supplied to the skill may cause it to request: - Services bound to localhost. - Private or link-local network addresses. - Cloud instance metadata endpoints. - Internal administrative applications. - Local files through supported non-HTTP URL handlers such as `file:`. - An attacker-controlled HTTP endpoint that redirects to a restricted destination. The full response is decoded and printed to standard output, potentially exposing retrieved internal or local content to the Agent context and subsequent output. The script also lacks a response-size limit, allowing a remote server to return excessive data and consume memory or context capacity. ### Attack Path 1. An attacker supplies a crafted URL while presenting it as a news article, alternate portal, or search result. 2. The Agent follows the documented workflow and executes `python fetch_url.py `. 3. `urlopen` connects to the supplied destination without scheme or network-boundary validation. 4. The target point ...[truncated 959 chars]- Remediation
View remediation