T09 · Insecure Skill Coding Practices
Warning
- Location
- scripts/generate_video.py:116
- Finding
- Unvalidated Server-Controlled Video Download URL## Vulnerability Details **File Location**: `scripts/generate_video.py`, lines 116–122 **Vulnerability Type**: Server-Side Request Forgery and Unbounded Download **Risk Level**: Medium ### Vulnerable Code ```python result = pilot(body) video_url = result["result"]["video_url"] # Download the video print(f"Downloading video from {video_url}...") video_resp = requests.get(video_url, timeout=120) video_resp.raise_for_status() output_path.write_bytes(video_resp.content) ``` ### Technical Analysis The video-generation API response fully controls `video_url`. The script passes this value directly to `requests.get()`, which follows redirects by default, without validating: - The URL scheme, hostname, credentials, or port - Whether the destination resolves to a loopback, private, link-local, or reserved address - Redirect destinations - The response content type - The response size If the SkillBoss API or its response path is compromised, an attacker could cause the script to request internal services, localhost endpoints, or cloud metadata services from the agent's network context. A public URL could also redirect to a prohibited internal destination. The response is buffered entirely in memory through `video_resp.content` and then written without a maximum size. A malicious endpoint could therefore cause excessive memory and disk consumption. This request is distinct from the expected transmission of the prompt and explicitly selected images to the declared SkillBoss API. Those transmissions are necessary for the documented remote video-generation functionality. The subsequent download nevertheless exceeds minimum privilege because it permits connections to arbitrary API-selected destinations. ### Attack Path 1. An attacker compromises the remote API, its response path, or another trusted component capable of influencing the API result. 2. The API returns a crafted `result.video_url` that points to an inte ...[truncated 1219 chars]
- Remediation
- ## Remediation Suggestions 1. Accept only `https` download URLs. 2. Enforce an explicit allowlist of trusted video-delivery hostnames and permitted ports. 3. Reject URLs containing embedded credentials. 4. Resolve the destination hostname and reject loopback, private, link-local, multicast, unspecified, and reserved IP ranges for both IPv4 and IPv6. 5. Disable automatic redirects or validate the scheme, hostname, port, and resolved addresses of every redirect target before following it. 6. Stream the response in bounded chunks rather than accessing `video_resp.content`. 7. Enforce a maximum download size using both `Content-Length`, when available, and a running byte counter while streaming. 8. Require an expected video media type, such as an approved `video/*` content type, and validate the downloaded file signature before announcing it as media. 9. Download to a safely created temporary file and atomically move it to the destination only after validation succeeds; delete partial files on failure. 10. Apply separate connection and read timeouts and handle network errors without printing unnecessary sensitive response details. 11. Document clearly that prompts and explicitly selected reference images are transmitted to SkillBoss API Hub for processing.