T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:199- Finding
Unrestricted Retrieval of User-Supplied URLs
- Content
View full analysis
-- From URL input 1. Fetch the URL content using available tools 2. Extract core arguments and data points 3. Skip Stage 1 (use extracted content as research) 4. Continue to Stage 2 (ideate) -> Stage 3 (write) -> Stage 4 (queue) 5. Record `source_url` in the entry ``` ### Technical Analysis The skill directs the agent to fetch an arbitrary URL supplied by the user without specifying any validation of the URL scheme, destination hostname, resolved IP address, redirect chain, or network classification. Depending on the capabilities and network access of the selected fetch tool, an attacker could supply URLs targeting: - Loopback services such as `127.0.0.1` or `localhost` - Private network addresses - Link-local addresses and cloud metadata services - Internal administrative or development services - Non-HTTP schemes, if supported by the underlying tool - Public URLs that redirect to otherwise prohibited destinations The fetched response is then treated as research material, processed into generated content, persisted in project files, and potentially displayed through review commands. This creates a possible path for unauthorized internal resource access and disclosure. ### Attack Path 1. An attacker invokes `/pipeline url ` with a URL pointing to an internal or sensitive endpoint. 2. The agent follows the instruction to fetch the URL using an available tool. 3. The fetch tool resolves and accesses the destination without a documented allowlist or private-address restriction. 4. The agent extracts arguments and data from the response. 5. The extracted material is used to create research and draft content. 6. Sensitive response data may be persisted in the research directory or `content-queue.json`, th ...[truncated 913 chars]- Remediation
View remediation