T09 · Insecure Skill Coding Practices
- Location
SKILL.md:152- Finding
Development Preview Server Exposed on All Network Interfaces
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 152–158
Vulnerability Type: Externally reachable unauthenticated development server
Risk Level: Mediumbash # 在游戏目录启动服务器 cd /tmp/game-build python -m http.server 8000 # 打开浏览器访问 http://localhost:8000Technical Analysis
The documented preview command starts Python's built-in HTTP server without specifying a bind address. By default,
python -m http.server 8000listens on all available network interfaces rather than only the loopback interface.Although the documentation describes the service as accessible through
localhost, that URL does not restrict the server's actual listening scope. If host firewall and network routing rules allow connections to port 8000, other systems can access the served directory. The server provides neither authentication nor TLS and may expose directory listings.Attack Path
- A user follows the skill instructions and creates game content under
/tmp/game-build. - The user executes
python -m http.server 8000. - The server binds to all network interfaces on TCP port 8000.
- An attacker with network access to the host identifies the open port.
- The attacker requests the server root or guesses file names.
- The attacker lists or downloads files located within
/tmp/game-build.
Exploitation depends on the host firewall, network configuration, and attacker reachability. No privilege escalation or code-execution path was established from the audited content.
Impact Assessment
A reachable attacker may obtain files within the served directory, potentially including generated game source,
request.txt, progress notes, and other files accidentally stored there. The exposure is limited to content available beneath the configured document root and lasts while the preview server is running.The attacker does not gain elevated operating-system privileges through this issue alone. The primary impact is unauthorized read access and loss o ...[truncated 78 chars]
- A user follows the skill instructions and creates game content under
- Remediation
View remediation
Remediation Suggestions
Bind the preview server explicitly to the IPv4 loopback interface:
bash cd /tmp/game-build python -m http.server 8000 --bind 127.0.0.1For IPv6-only local access, bind to
::1where supported. In addition:- Serve only a dedicated output directory containing files intended for preview.
- Do not store prompts, credentials, tokens, personal data, or development notes in the served directory.
- Confirm that firewall rules do not expose the preview port.
- Stop the server immediately after previewing.
- If remote preview is required, use an authenticated server with TLS and explicit access controls instead of Python's development server.
- Update all local-preview documentation and any future serving scripts to enforce loopback binding by default.