T09 · Insecure Skill Coding Practices
Warning
- Location
- SKILL.md:46
- Finding
- Untrusted API Discovery for Authenticated and State-Changing Operations## Vulnerability Details **File Location**: `SKILL.md`, lines 46-55 **Vulnerability Type**: Untrusted endpoint and authentication discovery **Risk Level**: Medium **Vulnerable Code Snippet**: ```markdown ## API Notes OpenCollab uses a REST API for: - GET /jobs — list available jobs - POST /proposals — submit proposal - GET /profile — get current profile (Use web search to find current API endpoints and authentication method) ``` ### Technical Analysis The Skill directs the agent to discover API endpoints and authentication procedures through unrestricted web search. It does not provide a pinned official HTTPS origin, trusted documentation URL, hostname allowlist, redirect restrictions, or requirements for independently validating the service identity. This is particularly unsafe because the described workflow involves account credentials and `POST /proposals`, an authenticated, state-changing operation. Search results and third-party documentation are untrusted inputs. Search poisoning, sponsored results, compromised documentation, or look-alike domains could cause the agent to follow an attacker-controlled authentication flow or send sensitive tokens to an unauthorized endpoint. The package contains no scripts implementing the proposed controls or operations, so this finding concerns the unsafe instruction and configuration practice in `SKILL.md`, not a confirmed credential-theft implementation. ### Attack Path 1. An attacker publishes or promotes a convincing page claiming to document the current OpenCollab API. 2. The agent follows the instruction to locate endpoints and authentication methods through web search. 3. The malicious page supplies an attacker-controlled API hostname or credential-exchange procedure. 4. The agent authenticates against that endpoint or includes a token in subsequent requests. 5. The attacker captures credentials or tokens and may use them to access the victim's marketplace accoun ...[truncated 605 chars]
- Remediation
- ## Remediation Suggestions 1. Pin the verified official API base URL and official documentation URL directly in the Skill. 2. Require HTTPS and enforce an explicit hostname allowlist for authentication and API requests. 3. Reject cross-origin redirects and verify the final request origin before attaching credentials. 4. Obtain API tokens only through the service's verified authentication flow and store them in an approved secret manager. 5. Never disclose tokens, passwords, private keys, or session cookies to search results, web pages, logs, prompts, or proposal content. 6. Use narrowly scoped, revocable credentials with the minimum permissions and lifetime required. 7. Require explicit user confirmation before account registration, profile publication, or proposal submission. 8. Add request previews, destination validation, audit logging, rate limits, and a dry-run mode for all state-changing operations. 9. Provide the referenced implementation files and subject their authentication, redirect handling, logging, and secret-management behavior to a separate code review before execution.