T09 · Insecure Skill Coding Practices
Warning
- Location
- SKILL.md:58
- Finding
- Unsafe URL Interpolation Enables Command Injection and Internal Resource Access<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:58-65` **Vulnerability Type**: Unsafe shell interpolation and unrestricted URL fetching **Risk Level**: Medium ### Vulnerable Code ```bash curl -sL "<url>" | python3 -c " import sys, re html = sys.stdin.read() # Strip tags, get text text = re.sub('<[^>]+>', ' ', html) text = re.sub(r'\s+', ' ', text).strip() print(text[:5000]) " ``` ### Technical Analysis The workflow instructs the agent to substitute a URL obtained from research results into a shell command. No validation, escaping mechanism, protocol allowlist, destination filtering, or argument-safe process invocation is specified. If the agent performs literal textual substitution, a URL containing shell metacharacters or quotation marks could escape the quoted argument and introduce additional shell commands. Execution would occur with the privileges of the account running the agent. The command also uses `curl -L`, which follows redirects without requiring each destination to be revalidated. An attacker-controlled public URL could redirect the request to localhost, a private network address, a link-local service, or a cloud metadata endpoint. Retrieved content would then enter the agent's context and could be exposed through the generated report. The command does **not** directly pipe downloaded code to Bash. Its response body is passed to a fixed Python text extraction program, so the pre-scan's characterization as direct remote payload execution is not supported. The risk instead arises from unsafe command construction and unrestricted outbound retrieval. ### Attack Path 1. An attacker supplies a crafted research URL or causes it to appear in search results. 2. The agent selects that URL for the documented deep-read operation. 3. The agent inserts the URL into the shell command without robust argument handling. 4. Either: - shell syntax embedded in the substituted value escapes the quoted argument and executes commands under the ...[truncated 1109 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Do not construct a shell command through textual URL interpolation. Pass the URL as a separate process argument using an execution API that does not invoke a shell. 2. If a shell is unavoidable, supply the URL through a positional parameter and apply robust shell quoting rather than inserting it into command text. 3. Permit only `https` and, if strictly necessary, `http`. Reject local-file, data, FTP, and other schemes. 4. Reject URLs containing credentials and block loopback, private, link-local, multicast, unspecified, and reserved IPv4 and IPv6 destinations. 5. Resolve the hostname before connecting and validate all resolved addresses. Reperform validation after DNS resolution changes. 6. Disable redirects or validate the scheme, hostname, and resolved destination of every redirect before following it. 7. Apply connection and total timeouts, response-size limits, content-type checks, and download limits. 8. Run network retrieval in a restricted environment without access to sensitive internal networks, metadata services, credentials, or unnecessary filesystem locations. 9. Treat retrieved pages as untrusted data and prevent their text from being interpreted as agent instructions. ]]>