T09 · Insecure Skill Coding Practices
- Location
SKILL.md:129- Finding
Unrestricted Callback URL May Enable SSRF and Unintended Result Disclosure
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, line 129
Vulnerability Type: Unrestricted callback destination
Risk Level: MediumComplete Code Snippet
markdown | callback_url | string | No | Callback notification URL used when asynchronous processing completes |The original field description defines an optional
callback_urlas the destination for asynchronous completion notifications.Technical Analysis
The Skill accepts a caller-provided callback URL but specifies no security controls for how an implementing Agent should validate or use it. In particular, it does not require:
- An allowlist of trusted callback domains
- HTTPS-only destinations
- Rejection of loopback, link-local, private-network, or cloud metadata addresses
- DNS rebinding protections
- Redirect validation
- Callback authentication
- Explicit user confirmation before transmitting results
- Data minimization for callback payloads
If an Agent implements this parameter by making an HTTP request to the supplied address, the callback becomes an attacker-controlled network sink. This can result in server-side request forgery or disclosure of research results. Asynchronous callbacks are not necessary for the documented synchronous Reddit research workflow, so this capability exceeds the minimum privileges required by the core functionality.
Attack Path
- An attacker supplies a research request containing a malicious
callback_url. - The URL points either to an attacker-controlled collection endpoint or to an address accessible only from the Agent's environment, such as localhost, a private-network service, or a cloud metadata endpoint.
- The Agent scans Reddit and generates the requested research output.
- The Agent sends a completion request or results to the supplied callback without adequate destination validation.
- The attacker receives research data, or the Agent reaches an otherwise inaccessi ...[truncated 775 chars]
- Remediation
View remediation
Remediation Suggestions
- Remove
callback_urlfrom the free synchronous workflow unless asynchronous delivery is an explicit requirement. - Require explicit user confirmation before sending any data to a callback destination.
- Restrict callbacks to HTTPS and an allowlist of trusted domains.
- Resolve and validate destination addresses before each request, rejecting loopback, link-local, private, reserved, multicast, and cloud metadata ranges for both IPv4 and IPv6.
- Disable redirects or revalidate every redirect target using the same destination controls.
- Protect against DNS rebinding by validating resolved addresses at connection time.
- Apply strict timeouts, response-size limits, request-rate limits, and fixed HTTP methods.
- Send only a minimal completion status or opaque job identifier rather than the full research report.
- Authenticate callbacks using a scoped signing secret or equivalent integrity mechanism, without embedding credentials in the URL.
- Document which payload fields are transmitted and ensure logs redact callback credentials and sensitive query parameters.
- Remove