T09 · Insecure Skill Coding Practices
- Location
SKILL.md:67- Finding
Unrestricted Fetching of User-Controlled URLs
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 16-17 and 67-75
Vulnerability Type: Server-Side Request Forgery (SSRF) and indirect prompt-injection exposure
Risk Level: MediumVulnerable code:
markdown - User message contains a URL/web link AND asks for citationmarkdown #### For Web Links Fetch the webpage content. Extract: 1. **Authors** — From byline, meta tags, or page content 2. **Title** — From `<title>` tag or page heading 3. **Website name** — Domain or site name 4. **Date** — Publication date (YYYY-MM-DD or YYYY-MM or YYYY) 5. **URL** — Full URL 6. **Access date** — Today's date in YYYY-MM-DDTechnical Analysis
The skill instructs the agent to fetch arbitrary URLs supplied by users without defining restrictions on URL schemes, destinations, DNS resolution, redirects, or network ranges. It does not prohibit requests to loopback, private, link-local, reserved, or cloud metadata addresses.
Consequently, if the underlying web-fetching tool can access such destinations, the agent may act as an SSRF proxy. Redirects or DNS rebinding could potentially bypass a check performed only on the original URL. The instructions also do not establish a trust boundary for retrieved content. A malicious webpage could contain instructions crafted to manipulate the agent rather than bibliographic data, creating indirect prompt-injection exposure.
Attack Path
- An attacker supplies a citation request containing an internal, loopback, link-local, cloud metadata, or attacker-controlled URL.
- The URL and citation request satisfy the skill's activation condition.
- Following the workflow, the agent fetches the supplied address.
- If network controls permit access, the request reaches a resource unavailable directly to the attacker.
- Response data may be processed and returned as citation fields, potentially disclosing internal information.
- Alternatively, an att ...[truncated 960 chars]
- Remediation
View remediation
Remediation Suggestions
- Accept only absolute
https://URLs and reject all other schemes, includingfile:,ftp:,data:, and custom schemes. - Resolve the hostname before making the request and reject loopback, private, link-local, multicast, reserved, and unspecified IP ranges for both IPv4 and IPv6.
- Explicitly block cloud metadata destinations, including link-local metadata addresses and provider-specific metadata hostnames.
- Revalidate the destination after every redirect and limit the number of redirects.
- Defend against DNS rebinding by connecting only to the validated resolved address and verifying the destination throughout the request.
- Apply strict connection and read timeouts, response-size limits, MIME-type restrictions, and download limits.
- Use a sandboxed fetch service with no access to internal networks, local files, ambient credentials, or authenticated browser sessions.
- Add an instruction that retrieved webpage content and metadata are untrusted data. They must only be parsed for bibliographic fields and must never be followed as agent instructions.
- Prefer extracting standardized metadata such as JSON-LD, Open Graph, Dublin Core, or citation meta tags rather than processing unrestricted page text.
- Return a safe validation error when a URL violates these controls.
- Accept only absolute