T09 · Insecure Skill Coding Practices
Warning
- Location
- SKILL.md:75
- Finding
- Unvalidated Remote Response URL Download<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 75-80 **Vulnerability Type**: Unvalidated remote URL retrieval and unsafe local file write **Risk Level**: Medium ### Vulnerable Code ```bash URL=$(curl -s -X POST https://api.heybossai.com/v1/run \ -H "Authorization: Bearer $SKILLBOSS_API_KEY" \ -H "Content-Type: application/json" \ -d '{"model": "mm/img", "inputs": {"prompt": "A sunset over mountains"}}' \ | jq -r '.image_url // .result.image_url // .data[0]') curl -sL "$URL" -o sunset.png ``` ### Technical Analysis The URL extracted from the remote API response is passed directly to `curl`. The command follows redirects with `-L` and does not validate the URL scheme, destination hostname, resolved IP address, response size, or content type. Shell-command injection is mitigated by quoting `"$URL"`, and the downloaded file is not automatically executed. Nevertheless, the API response remains a remote trust boundary. If the API account, service, upstream model provider, or response-processing infrastructure is compromised, an attacker can cause the agent to issue a GET request to an attacker-selected or internal destination. The downloaded response is then written to a predictable path, `sunset.png`, in the current directory without checking whether that path already exists or is a symbolic link. ### Attack Path 1. An attacker compromises or manipulates the API response or one of its upstream providers. 2. The response supplies a malicious `image_url`, `result.image_url`, or `data[0]` value. 3. The Skill extracts that value without validation. 4. `curl -L` follows the supplied URL and any subsequent redirects. 5. The request can reach an attacker-controlled host or, where network access permits, a private or loopback address. 6. The returned data is written to `sunset.png`; an existing file or symbolic-link target accessible to the agent may be overwritten. ### Impact Assessment The vulnerability can provide an attacker w ...[truncated 499 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Parse and validate the response before using any returned URL. 2. Permit only `https` URLs and reject embedded credentials, nonstandard schemes, and malformed values. 3. Restrict downloads to an explicit allowlist of trusted media-delivery domains. 4. Resolve the hostname and reject loopback, link-local, private, reserved, and cloud metadata address ranges before connecting and after every redirect. 5. Disable unrestricted redirects or validate every redirect destination. 6. Apply connection, total-time, and maximum-download-size limits. 7. Validate the response status and expected media MIME type before retaining the file. 8. Create the destination securely in an approved output directory, reject symbolic links, and avoid overwriting existing files unless the user explicitly approves it. 9. Prefer a service-generated immutable object identifier over an arbitrary response URL where the API supports one. ]]>