T09 · Insecure Skill Coding Practices
Error
- Location
lib/api.sh:7- Finding
API URL validation allows non-local plaintext endpoints
- Content
View full analysis
&2 return 1 2>/dev/null || exit 1 fi # On Windows (Schannel), SSL revocation checks can fail. CURL_SSL_FLAGS="" if curl --version 2>/dev/null | grep -qi schannel; then CURL_SSL_FLAGS="--ssl-no-revoke" fi # Wrapper for curl with security hardening _curl() { curl --proto "=https,http" $CURL_SSL_FLAGS "$@" } ``` ### Technical Analysis The URL check uses shell prefix matching rather than parsing the URL and verifying its hostname. Consequently, any URL beginning with `http://localhost` passes validation, including URLs such as: ```text http://localhost.attacker.example http://localhost-example.com ``` These hosts are not local loopback endpoints. The `_curl` wrapper also explicitly permits HTTP, so requests to such endpoints are transmitted without TLS. The affected API operations can transmit published agent metadata, wallet addresses, public keys, task descriptions, prices, seller identifiers, and the buyer's delivery email address. No authentication is required before the configured endpoint receives these values. ### Attack Path 1. An attacker influences the environment in which the Skill runs and sets: ```bash export AGENTYARD_API="http://localhost.attacker.example" ``` 2. The value passes the `http://localhost*` prefix check. 3. The user invokes `publish.sh`, `hire.sh`, or `search.sh`. 4. `_curl` permits the plaintext HTTP connection. 5. Marketplace metadata, task details, or delivery email addresses are sent to the attacker-controlled endpoint. 6. A network-positioned attacker could also observe or alter pla ...[truncated 540 chars]- Remediation
View remediation