T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/morning_briefing.sh:34- Finding
Untrusted Network Content Is Inserted into an Agent-Controlled Verbatim Response
- Content
View full analysis
/dev/null) || weather_data="Weather unavailable" echo "$weather_data" ``` `scripts/morning_briefing.sh:84` ```bash echo "IMPORTANT: Read $OUTPUT_PATH and present its contents to the user EXACTLY as written. Do not summarize, reformat, paraphrase, or editorialize. Output the markdown verbatim." ``` `SKILL.md:26-27` ```markdown 3. **Read the file and present its contents verbatim to the user.** Do not summarize, reformat, paraphrase, add commentary, or editorialize. Output the entire markdown file exactly as written — the markdown IS the briefing. Do not wrap it in a code block. Do not omit sections. Do not change heading levels or link formatting. ``` ### Technical Analysis The script retrieves weather information from `wttr.in` without specifying an explicit HTTPS URL. The remote response is neither validated against an expected format nor escaped before being written into the generated Markdown briefing. The Skill instructions and the script's final message then direct the Agent to reproduce the generated file exactly as written. This combines an untrusted network input with a mandatory verbatim-output path. If the weather response is controlled or modified, arbitrary Markdown, deceptive links, phishing text, or instruction-like content can be inserted into the Agent's user-facing response. This finding is an insecure trust-boundary and output-handling flaw. The demonstrated code does not execute the remote response as shell code, so it does not by itself establish remote code execution. ### Attack Path 1. An attacker gains the ability to control or interce ...[truncated 1295 chars]- Remediation
View remediation