T09 · Insecure Skill Coding Practices
Warning
- Location
index.js:195- Finding
Unescaped User-Controlled API Path and Query Components
- Content
View full analysis
} Crawled pages with content */ export async function anycrawl_crawl_results({ job_id, skip = 0 }) { if (!job_id) { throw new Error("Job ID is required"); } return await anycrawlRequest(`/crawl/${job_id}?skip=${skip}`); } /** * Cancel a crawl job * * @param {Object} params * @param {string} params.job_id - Crawl job ID (required) * * @returns {Promise} Cancellation confirmation */ export async function anycrawl_crawl_cancel({ job_id }) { if (!job_id) { throw new Error("Job ID is required"); } return await anycrawlRequest(`/crawl/${job_id}`, { method: "DELETE" }); } ``` ### Technical Analysis The `job_id` value is inserted directly into URL paths without validation or percent-encoding. The `skip` value is likewise interpolated directly into a query string without enforcing its documented numeric type. An attacker who can supply tool arguments may include path separators, traversal components, query delimiters, or fragment delimiters. When the resulting string is processed as a URL, these characters can alter the intended API path or query parameters rather than remaining part of a single job identifier. The risk is particularly significant in `anycrawl_crawl_cancel`, because the manipulated endpoint receives an authenticated `DELETE` request. The shared `anycrawlRequest` function automatically at ...[truncated 2183 chars]- Remediation
View remediation