T09 · Insecure Skill Coding Practices
- Location
SKILL.md:75- Finding
Unvalidated Server-Controlled URL Download
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 75–80
Vulnerability Type: Unvalidated remote URL retrieval
Risk Level: Mediumbash URL=$(curl -s -X POST https://api.heybossai.com/v1/run \ -H "Authorization: Bearer $SKILLBOSS_API_KEY" \ -H "Content-Type: application/json" \ -d '{"model": "mm/img", "inputs": {"prompt": "A sunset over mountains"}}' \ | jq -r '.image_url // .result.image_url // .data[0]') curl -sL "$URL" -o sunset.pngTechnical Analysis
The remote API controls the value assigned to
URL, which is passed directly tocurl -Lwithout validating the URL scheme, destination hostname, port, resolved IP address, or redirect chain.If the API or an upstream provider is compromised, its response could direct the Agent to an unintended destination. Depending on the protocols enabled in the installed curl build, possible destinations may include external hosts, loopback interfaces, private-network services, link-local services, cloud metadata endpoints, or local resources. The
-Loption also follows redirects without revalidating each destination.This is an insecure coding pattern because a trust boundary exists between the API response and the network-capable download command.
Attack Path
- The Agent submits an image-generation request to the documented API.
- A compromised or malicious API component returns an attacker-selected value in
image_url,result.image_url, ordata[0]. - The shell extracts that value without checking its type or destination.
curl -Lrequests the supplied URL and follows attacker-controlled redirects.- The Agent host accesses an unintended external, internal, loopback, or local resource.
- The response is written to
sunset.png.
Impact Assessment
Successful exploitation could use the Agent host as a network-access proxy and permit reading responses from services reachable by that host, including internal or link-local endpoints. It could also overwrite ...[truncated 414 chars]
- Remediation
View remediation
Remediation Suggestions
- Accept only HTTPS URLs and explicitly disable every other protocol:
bash curl --proto '=https' --proto-redir '=https' ... - Enforce an explicit allowlist of trusted media-delivery hostnames.
- Reject URLs containing embedded credentials, fragments, unexpected ports, malformed hosts, or ambiguous IP representations.
- Resolve the hostname before downloading and block loopback, private, link-local, multicast, reserved, and cloud-metadata address ranges for both IPv4 and IPv6.
- Revalidate the scheme, hostname, port, and resolved address after every redirect, or disable redirects unless they are required.
- Verify that the extracted JSON field is a nonempty string and fail safely when the API response does not match the expected schema.
- Apply connection, transfer, and file-size limits to reduce denial-of-service exposure.
- Download to a securely created temporary file, validate the response content type and file signature, and atomically move it to the final path only after validation.
- Do not execute, render, or otherwise trust the downloaded file solely based on its extension.
- Accept only HTTPS URLs and explicitly disable every other protocol: