T09 · Insecure Skill Coding Practices
- Location
SKILL.md:275- Finding
JavaScript Pattern Builder Is Invoked Before Definition, Preventing Scanner Startup
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md:275-345
Vulnerability Type: Security scanner initialization failure
Risk Level: MediumVulnerable Code
The
PATTERNSregistry invokes_build_js_ssrf_patterns()before Python has executed the function definition:python ".js": _build_js_ssrf_patterns(), ".ts": _build_js_ssrf_patterns(),The function is only defined later in the module:
python def _build_js_ssrf_patterns(): return [ ("FETCH_USER_URL", re.compile(r'\bfetch\s*\(\s*req\.[a-zA-Z.[\]\'"]+'), CRITICAL, "fetch() with request parameter URL is a direct SSRF vector.", "Validate URL with new URL(userUrl).hostname against allowlist. " "Block private IP ranges (10.x, 172.16-31.x, 192.168.x, 127.x, 169.254.x)."),Technical Analysis
Python evaluates module-level dictionary values while importing or executing the module. At line 275,
_build_js_ssrf_patternshas not yet been bound because itsdefstatement is not reached until line 345. Evaluation therefore raises:text NameError: name '_build_js_ssrf_patterns' is not definedThe exception occurs during module initialization, before argument parsing, file enumeration, SSRF analysis, report generation, or CI severity evaluation. Consequently, the documented scanner cannot perform its declared security function in its current form.
This is an insecure implementation practice affecting the availability and reliability of a security control. It is not evidence of malicious code, privilege escalation, credential theft, or network access.
Attack Path
- A user extracts the documented Python implementation into
audit_ssrf.py. - The user or CI pipeline invokes
python3 audit_ssrf.py --ci. - Python begins constructing the module-level
PATTERNSdictionary. - Evaluation reaches
_build_js_ssrf_patterns()before the function de ...[truncated 1519 chars]
- A user extracts the documented Python implementation into
- Remediation
View remediation
Remediation Suggestions
- Move the complete
_build_js_ssrf_patternsfunction definition above the module-levelPATTERNSassignment. - Alternatively, define JavaScript and TypeScript patterns directly as constants before constructing
PATTERNS. - Add an import/startup regression test that verifies the module loads without exceptions.
- Add tests confirming that representative JavaScript and TypeScript SSRF sinks are detected.
- Add end-to-end tests covering:
- A clean source tree.
- A source tree containing critical SSRF patterns.
- Human-readable output.
- JSON output.
--ciexit behavior.
- Configure CI to distinguish scanner execution errors from completed scans with security findings, while treating both as pipeline failures.
- Emit an explicit completion marker and scanned-file count so downstream automation can verify that analysis actually finished.
- Consider reporting excluded directories such as
test,tests,fixtures, andvendor, or make exclusions configurable, to avoid ambiguity about audit coverage.
- Move the complete