T09 · Insecure Skill Coding Practices
- Location
scripts/upload.sh:20- Finding
Arbitrary Local Files Can Be Uploaded to a Public External Service
- Content
View full analysis
Vulnerability Details
File Location:
scripts/upload.sh:20-36
Vulnerability Type: Insufficient file-type validation before external upload
Risk Level: MediumVulnerable Code
bash if [ ! -f "$IMAGE_PATH" ]; then exit 1 fi FILENAME=$(basename "$IMAGE_PATH") RESPONSE=$(curl -s -X POST "$API" \ -H "accept: */*" \ -F "file=@${IMAGE_PATH}" \ -F "expiresIn=${EXPIRES}" \ 2>&1)Technical Analysis
The Skill is documented as an image-upload utility supporting formats such as PNG, JPEG, GIF, WebP, and BMP. However, the implementation only verifies that the supplied path refers to a regular file. It does not validate:
- The file extension against the documented image allowlist.
- The detected MIME type.
- The file signature or magic bytes.
- Whether the extension, MIME type, and file contents agree.
- The file size.
- Whether the user has explicitly approved transferring the resolved file to an external service.
The path is then passed directly to the multipart
curlupload usingfile=@${IMAGE_PATH}. Consequently, any locally readable regular file can be transferred tohttps://api.imgland.net/v1/images, regardless of whether it is an image.Shell command injection was not identified because the path and expiration arguments are quoted. The security issue is the missing content and authorization boundary validation before public external transmission.
Attack Path
- An attacker-controlled instruction, untrusted prompt, or user mistake causes the Agent to invoke the Skill with the path of a sensitive local file rather than an image.
- The script expands a leading tilde and checks only whether the supplied path is a regular file.
- Because no extension, MIME, signature, or approved-directory validation is performed, the sensitive file passes the check.
curluploads the file to the third-party image-hosting API.- The API response provides a public URL, potentially exposing the file to anyone who obtain ...[truncated 816 chars]
- Remediation
View remediation
Remediation Suggestions
- Enforce a strict allowlist of supported extensions after converting the extension to lowercase.
- Detect the file MIME type locally and allow only expected image media types such as
image/png,image/jpeg,image/gif,image/webp, andimage/bmp. - Validate image signatures or decode the file with a trusted image parser; do not rely solely on extensions or caller-provided MIME types.
- Require the extension, detected MIME type, and file signature to agree.
- Resolve the canonical file path and present it to the user before upload.
- Require explicit user confirmation that the displayed file will be transferred to a third-party public hosting service.
- Apply a maximum file-size limit before initiating the network request.
- Consider restricting uploads to user-approved directories or files explicitly selected during the current interaction.
- Reject symbolic-link and path-resolution anomalies where appropriate for the intended workflow.
- Clearly disclose the external destination, public accessibility, retention period, and deletion behavior before uploading.
- Minimize exposure of the deletion secret and avoid displaying or logging the deletion URL unless it is necessary for the user.