T09 · Insecure Skill Coding Practices
Error
- Location
SKILL.md:144- Finding
Arbitrary API endpoint can receive sensitive PDF contents and bearer credentials
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 144-162
Vulnerability Type: Insufficient endpoint validation, plaintext transmission, and potential server-side request forgery
Risk Level: HighVulnerable Code
python def _validate_url(url): parsed = urlparse(url) if parsed.scheme not in ('http', 'https'): raise ValueError(...) if parsed.hostname in ('localhost', '127.0.0.1', '0.0.0.0'): raise ValueError(...) return urlpython def compress_pdf(file_path, api_key=None, quality=75, dpi=144): api_url = os.getenv("COMPRESS_PDF_API_URL", "") if not api_url: raise ValueError(...) _validate_url(api_url) api_key = api_key or os.getenv("COMPRESS_PDF_API_KEY", "") headers = {"Authorization": f"Bearer {api_key}"} files = {"file": open(file_path, "rb")} data = {"imageQuality": quality, "dpi": dpi} resp = requests.post(api_url, headers=headers, files=files, data=data) return resp.json()Technical Analysis
The Skill reads a local PDF and sends its contents, compression parameters, and a bearer API credential to an endpoint controlled through
COMPRESS_PDF_API_URL. Uploading a document is necessary for the declared remote compression service, but accepting an arbitrary destination is broader than the minimum privilege required.The endpoint validation only checks the URL scheme and rejects three literal hostnames. It still permits:
- Plaintext HTTP endpoints, allowing network interception or modification.
- RFC1918 private network addresses.
- IPv6 loopback and private addresses.
- Link-local addresses and cloud metadata services such as
169.254.169.254. - Reserved or alternative IP representations.
- Hostnames that resolve to internal addresses.
- DNS rebinding scenarios.
- Untrusted public domains unrelated to the intended compression provider.
Because the bearer token and ...[truncated 1791 chars]
- Remediation
View remediation
Remediation Suggestions
- Require HTTPS and reject plaintext HTTP without an override.
- Replace the arbitrary endpoint setting with an allowlist containing the official compression-service hostname and expected port.
- Resolve the hostname before connecting and reject loopback, private, link-local, multicast, reserved, unspecified, and metadata-network addresses for both IPv4 and IPv6.
- Protect against DNS rebinding by ensuring the validated address is the address used for the connection.
- Disable redirects, or validate every redirect destination using the same hostname and IP controls.
- Display the exact destination and obtain explicit user consent before uploading a document.
- Apply connection and read timeouts, maximum file-size limits, and response-size limits.
- Open the PDF through a context manager so the file descriptor is closed reliably.
- Avoid sending an empty
Authorizationheader and scope API credentials to the minimum service permissions. - Document the external data-processing destination and warn users that their PDF leaves the local environment.