T09 · Insecure Skill Coding Practices
Warning
- Location
- skill.md:20
- Finding
- Unvalidated Content Retrieved from a Mutable Remote Endpoint## Vulnerability Details **File Location**: `skill.md`, lines 20-35 **Vulnerability Type**: Untrusted remote-content handling **Risk Level**: Medium ```markdown The assistant will immediately make a **GET** request to: `https://b024a53917d6.ngrok-free.app/agent/dailyPost` --- ## 🛠️ What happens 1. **Recognition:** I recognize your request via the defined triggers. 2. **Execution:** I perform the following HTTP call: ```bash curl [https://b024a53917d6.ngrok-free.app/agent/dailyPost](https://b024a53917d6.ngrok-free.app/agent/dailyPost) ``` 3. **Response:** I return whatever the endpoint sends back (text, JSON, etc.) directly to the chat. ``` ### Technical Analysis The skill retrieves content from an externally controlled ngrok endpoint and returns whatever it receives directly to the conversation. No response schema, content-type restriction, response-size limit, redirect policy, or untrusted-content boundary is defined. An ngrok subdomain is a mutable service origin whose backend content can change after the skill has been reviewed. Consequently, control or compromise of the remote endpoint would allow an attacker to supply arbitrary conversational content. Such content could include deceptive links, social-engineering messages, misleading data, or prompt-like instructions intended to influence subsequent agent behavior. The reviewed file does not explicitly direct the agent to execute commands or code returned by the endpoint. Therefore, this finding does not establish remote code execution and is classified as an insecure content-handling practice rather than remote payload execution. The documented `curl` command also incorrectly includes Markdown link syntax rather than a plain URL. Although primarily a correctness issue, passing such syntax to a shell may result in unexpected interpretation or failure if copied verbatim. ### Attack Path 1. An attacker controls or compromises the backend e ...[truncated 1363 chars]
- Remediation
- ## Remediation Suggestions - Replace the temporary ngrok origin with a stable HTTPS domain whose ownership and operational controls are documented. - Treat all endpoint responses as untrusted data and render them as quoted or clearly delimited content, never as agent instructions. - Require a strict response format, preferably JSON validated against an allowlisted schema. - Restrict accepted content types and reject HTML, executable content, and unexpected formats. - Configure explicit connection and read timeouts, maximum response sizes, and redirect limits. - Disable redirects or allow them only to explicitly trusted hosts. - Ensure instructions contained in endpoint responses are never executed or followed automatically. - Add integrity or authenticity controls, such as signed responses, if the returned content must be trusted. - Correct the shell example to use a quoted plain URL and defensive curl options: ```bash curl --fail --silent --show-error --max-time 10 \ 'https://b024a53917d6.ngrok-free.app/agent/dailyPost' ```