T09 · Insecure Skill Coding Practices
Warning
- Location
- SKILL.md:17
- Finding
- Unencrypted RSS Feed Permits Content Manipulation## Vulnerability Details **File Location**: `SKILL.md`, line 17 **Vulnerability Type**: Plaintext external content retrieval **Risk Level**: Medium ### Vulnerable Code Snippet ```markdown 1. **Variety** (http://variety.com/feed/) - Business and production standards. ``` ### Technical Analysis The skill explicitly instructs the agent to retrieve the Variety RSS feed over plaintext HTTP. HTTP provides neither transport confidentiality nor cryptographic server authentication and integrity. An attacker with a suitable network position could intercept the request and modify the feed response before it reaches the agent. Because external feed content is used to construct the news digest, manipulated titles, article text, or links could be treated as legitimate source material. An attacker could consequently introduce false reporting, malicious links, or adversarial instructions embedded in feed content. The project does not document HTTPS enforcement, redirect validation, content sanitization, or isolation of retrieved text as untrusted data. ### Attack Path 1. The skill invokes `web_fetch` for `http://variety.com/feed/`. 2. A network-positioned attacker intercepts the unencrypted HTTP request or response. 3. The attacker replaces or modifies RSS entries, article links, or embedded text. 4. The agent processes the modified response during aggregation and analysis. 5. Fabricated information or attacker-controlled links may appear in the resulting digest. If retrieved content is not treated strictly as data, embedded adversarial text could also attempt to influence subsequent agent behavior. ### Impact Assessment The primary impact is loss of integrity and authenticity for one of the skill's curated information sources. An attacker could manipulate rankings, introduce false industry news, redirect users to malicious websites, or reduce confidence in cross-source verification. This issue does not itself grant local system p ...[truncated 325 chars]
- Remediation
- ## Remediation Suggestions 1. Replace the plaintext endpoint with `https://variety.com/feed/`. 2. Require HTTPS for every external source and reject any redirect that downgrades from HTTPS to HTTP. 3. Validate final redirect destinations against an explicit allowlist of trusted hostnames. 4. Treat all retrieved feed and article content as untrusted data rather than executable instructions. 5. Prevent fetched content from overriding system, developer, user, or skill instructions. 6. Sanitize and validate externally supplied links before displaying or opening them. 7. Where practical, corroborate significant stories through multiple independently secured sources before including them in the final digest.