T09 · Insecure Skill Coding Practices
Warning
- Location
- scripts/morning_briefing.sh:34
- Finding
- Untrusted Network Content Is Inserted into an Agent-Controlled Verbatim Response<![CDATA[ ## Vulnerability Details **File Location**: `scripts/morning_briefing.sh:34-35,84`; `SKILL.md:26-27` **Vulnerability Type**: Unvalidated remote content injection into an Agent response **Risk Level**: Medium ### Vulnerable Code `scripts/morning_briefing.sh:34-35` ```bash weather_data=$(curl -s --max-time 10 "wttr.in/${location}?format=%l:+%c+%t+(feels+like+%f),+%w+wind,+%h+humidity" 2>/dev/null) || weather_data="Weather unavailable" echo "$weather_data" ``` `scripts/morning_briefing.sh:84` ```bash echo "IMPORTANT: Read $OUTPUT_PATH and present its contents to the user EXACTLY as written. Do not summarize, reformat, paraphrase, or editorialize. Output the markdown verbatim." ``` `SKILL.md:26-27` ```markdown 3. **Read the file and present its contents verbatim to the user.** Do not summarize, reformat, paraphrase, add commentary, or editorialize. Output the entire markdown file exactly as written — the markdown IS the briefing. Do not wrap it in a code block. Do not omit sections. Do not change heading levels or link formatting. ``` ### Technical Analysis The script retrieves weather information from `wttr.in` without specifying an explicit HTTPS URL. The remote response is neither validated against an expected format nor escaped before being written into the generated Markdown briefing. The Skill instructions and the script's final message then direct the Agent to reproduce the generated file exactly as written. This combines an untrusted network input with a mandatory verbatim-output path. If the weather response is controlled or modified, arbitrary Markdown, deceptive links, phishing text, or instruction-like content can be inserted into the Agent's user-facing response. This finding is an insecure trust-boundary and output-handling flaw. The demonstrated code does not execute the remote response as shell code, so it does not by itself establish remote code execution. ### Attack Path 1. An attacker gains the ability to control or interce ...[truncated 1295 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Use an explicit authenticated transport URL: ```bash https://wttr.in/... ``` 2. Enable strict curl failure behavior and safe redirects, for example with `--fail`, `--show-error`, an appropriate redirect policy, and existing connection and overall timeouts. 3. Validate the response against a narrowly defined expected format before including it in the briefing. Reject multiline responses, unexpected control characters, Markdown constructs, and content exceeding a conservative size limit. 4. Escape externally supplied text before inserting it into Markdown, particularly link syntax, HTML, headings, and other formatting metacharacters. 5. Keep untrusted source data clearly separated from Agent instructions. Do not instruct the Agent to reproduce a file containing remote data unconditionally or verbatim. 6. Treat generated briefings as untrusted content and explicitly instruct the Agent not to follow commands or instructions embedded in source material. 7. On validation or transport failure, emit a fixed local message such as `Weather unavailable` rather than preserving an unexpected remote response. ]]>