T09 · Insecure Skill Coding Practices
- Location
SKILL.md:23- Finding
Unrestricted User-Controlled URL Retrieval May Enable Server-Side Request Forgery
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, line 23
Vulnerability Type: Server-Side Request Forgery through unrestricted URL retrieval
Risk Level: MediumRelevant instruction translated into English:
markdown ### Step 1: Read the Full Paper Use the `pdftotext` command or the `read` action of the `file` tool to extract the full text of the paper. For papers supplied through a URL, first attempt to download the PDF and then extract it. Coverage must include everything from the abstract through the references. For papers containing important figures or tables, use the `view` action of the `file` tool to inspect the relevant pages and save the figure or table information to a text file.Technical Analysis
The workflow instructs the agent to download content from a user-supplied URL without specifying any URL validation or network-access restrictions. It does not restrict schemes to HTTPS, reject loopback or private-network destinations, prevent DNS rebinding, validate each redirect destination, limit download size, or verify that the retrieved object is genuinely a PDF before further processing.
An attacker could provide a URL targeting a service reachable from the agent but inaccessible externally, such as a loopback interface, private network host, link-local endpoint, or cloud instance metadata service. Redirects or attacker-controlled DNS records could also be used to bypass validation if checks are performed only on the initial URL. Oversized or non-PDF responses could cause resource exhaustion or unsafe downstream parser behavior.
Exploitability depends on the capabilities and network privileges of the downloader selected by the host agent. The Skill does not itself contain executable download code or instructions to disclose retrieved content to a third party.
Attack Path
- An attacker asks the Skill to analyze a paper hosted at an attacker-selected URL.
- The URL points directly, ...[truncated 1238 chars]
- Remediation
View remediation
Remediation Suggestions
- Accept only
https://URLs and explicitly reject local-file and other non-HTTP schemes. - Parse and canonicalize the URL with a well-tested URL library before making a request.
- Resolve the hostname and reject loopback, link-local, private, multicast, reserved, unspecified, and cloud metadata address ranges for both IPv4 and IPv6.
- Repeat hostname resolution and destination validation for every redirect, and impose a strict redirect limit.
- Protect against DNS rebinding by ensuring the validated address is the address used for the connection.
- Where practical, allow downloads only from approved academic publishers, repositories, or object-storage domains.
- Apply strict connection, read, and total-operation timeouts.
- Enforce maximum response and extracted-file sizes before buffering or processing content.
- Require an expected PDF content type and verify the PDF file signature before invoking extraction or viewing tools.
- Store downloads in a uniquely created, permission-restricted temporary directory and delete them after processing.
- Run document parsers with minimal privileges and without unnecessary network access.
- Avoid including retrieved internal content in reports when destination validation fails, and log blocked requests without recording sensitive response bodies.
- Accept only