Phy Security Headers

• Outcome: Review
• Latest audit: Sep 14, 2026 · 9:32 PM UTC
• Version: 1.0.3

Overview

This skill does what it claims, but its unrestricted URL fetching can make the agent probe local or private network services.

Install only if you are comfortable with the agent making outbound curl requests from your machine or runtime. Use it only on domains or local services you control, and avoid running audits on URLs supplied by untrusted parties unless the skill adds URL validation and private-network protections.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:114

Finding

Unrestricted URL Fetching Enables Server-Side Request Forgery

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 114–119
Vulnerability Type: Server-Side Request Forgery (SSRF) through unrestricted URL fetching
Risk Level: High

Vulnerable Code

python

def fetch_headers(url: str) -> dict[str, str]:
    """Fetch HTTP response headers from URL."""
    result = subprocess.run(
        ['curl', '-sI', url, '--max-time', '10', '-L',
         '--user-agent', 'SecurityHeaderAuditor/1.0'],
        capture_output=True, text=True
    )

Technical Analysis

The Skill passes a user-controlled URL directly to curl without validating its scheme, hostname, resolved IP address, port, or redirect destinations. Because curl is executed with -L, an attacker-controlled public URL can redirect the request to a loopback, private, link-local, or cloud metadata address.

The documentation also explicitly supports http://localhost:3000, confirming that access to services on the Agent's local network is intentional but unrestricted. Local development support may be legitimate, but exposing it to arbitrary requesters exceeds least privilege unless authorization and destination controls are enforced.

The use of an argument array in subprocess.run prevents conventional shell metacharacter injection. The confirmed issue is SSRF and network-boundary bypass, not shell command injection.

The request sends a fixed User-Agent and ordinary HTTP request metadata. No deliberate transmission of local credentials, environment variables, files, or secrets was identified. Nevertheless, automatically attached network credentials or infrastructure-specific headers may still be exposed depending on the execution environment and proxy configuration.

Attack Path

1. An attacker requests an audit of an internal address, such as a loopback service, private network host, or cloud metadata endpoint.
2. Alternatively, the attacker supplies a public URL under their control that redirects to an internal destination.
3. The Ag ...[truncated 1286 chars]

Remediation

View remediation

Remediation Suggestions

1. Parse input URLs with a strict URL parser and permit only explicitly required schemes, preferably https and optionally http.
2. Reject URLs containing embedded credentials, malformed authorities, unsupported ports, or ambiguous host representations.
3. Resolve the hostname before connecting and reject every address in loopback, private, link-local, multicast, reserved, unspecified, and cloud-metadata ranges.
4. Revalidate the resolved address at connection time to mitigate DNS rebinding and time-of-check/time-of-use issues.
5. Disable automatic redirects where possible. If redirects are required, validate the scheme, hostname, port, and resolved address of every redirect target before following it.
6. Make localhost and private-network auditing an explicit privileged mode that requires authorization rather than enabling it for arbitrary requests.
7. Apply an outbound network policy that blocks metadata endpoints and internal ranges by default.
8. Use an allowlist of approved domains when the operating context permits it.
9. Restrict destination ports to those required for HTTP security-header auditing.
10. Return a clear validation error without including sensitive internal resolution or connectivity details.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

This markdown skill explicitly lists trigger phrases, and one of them is generic enough to match ordinary conversation outside the intended security-audit context. Because the file does not provide exclusion conditions or negative examples, this broad phrase could cause unintended invocation.

Content

No source excerpt is available for this finding.

Vague Triggers

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

Unlike "CSP audit", the phrase "content security policy" could appear in general discussion, documentation, or troubleshooting contexts without meaning to invoke the skill. The trigger list does not narrow whether mention alone should activate the skill.

Content

No source excerpt is available for this finding.