T09 · Insecure Skill Coding Practices
- Location
scripts/solscan.py:27- Finding
Missing HTTP Request Timeout Can Indefinitely Block Skill Execution
- Content
View full analysis
Vulnerability Details
File Location:
scripts/solscan.py:27
Vulnerability Type: Unbounded network request duration
Risk Level: LowVulnerable Code
python try: response = requests.get(url, headers=headers, params=params) response.raise_for_status() return response.json() except requests.exceptions.RequestException as e: print(f"API Request Error: {e}", file=sys.stderr)Technical Analysis
The call to
requests.get()does not specify a connection or read timeout. The Requests library therefore permits the operation to wait indefinitely if the connection establishment or response transfer stalls.Although the destination is a fixed HTTPS Solscan API endpoint, an API outage, network failure, dropped response, or an attacker capable of disrupting the network path could leave the process blocked. Repeated invocations could accumulate waiting processes or consume the Agent host's execution capacity.
The API key is sent only to the fixed Solscan HTTPS origin and is not exposed by this issue. The network access itself is necessary for the Skill's declared functionality and does not exceed minimum privilege.
Attack Path
- A user or Agent invokes any supported account, token, or market query.
- The script calls the fixed Solscan API endpoint through
requests.get(). - The API or network path accepts the connection but fails to complete the response, or otherwise stalls the request.
- Because no timeout is configured, the script remains blocked without an application-enforced deadline.
- Repeated concurrent calls can consume worker slots and degrade the availability of the Agent environment.
Impact Assessment
The issue affects availability only. It does not grant an attacker additional system privileges, expose the API key, enable arbitrary code execution, or permit access to unrelated local data. Its scope is limited to the running process and, if many blo ...[truncated 93 chars]
- Remediation
View remediation
Remediation Suggestions
Configure explicit connection and read timeouts:
python try: response = requests.get( url, headers=headers, params=params, timeout=(5, 30), ) response.raise_for_status() return response.json() except requests.exceptions.Timeout: print("API Request Error: request timed out.", file=sys.stderr) sys.exit(1) except requests.exceptions.RequestException as e: print(f"API Request Error: {e}", file=sys.stderr) if e.response is not None: print(f"Response Body: {e.response.text}", file=sys.stderr) sys.exit(1)If automatic retries are required, use a
requests.Sessionwith bounded retry counts and exponential backoff. Retry only transient failures, such as timeouts, HTTP 429 responses, and selected 5xx responses. Enforce a total retry deadline to prevent retries from recreating an unbounded wait.