T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/fetch-stitch.sh:8- Finding
Unrestricted URL Retrieval and Arbitrary Output Path
- Content
View full analysis
" echo "Example: $0 'https://storage.googleapis.com/...' '.stitch/designs/index.html'" exit 1 fi # Create output directory if needed mkdir -p "$(dirname "$OUTPUT")" echo "Fetching Stitch asset..." echo " URL: $URL" echo " Output: $OUTPUT" curl -L -f -sS \ --connect-timeout 15 \ --max-time 60 \ --compressed \ --retry 2 \ --retry-delay 1 \ "$URL" -o "$OUTPUT" ``` ### Technical Analysis The script accepts both its source URL and output path directly from command-line arguments without applying security restrictions. The URL is passed to `curl -L`, which follows redirects without validating the original or final protocol, hostname, resolved address, or port. Although documented invocations use Google Stitch and Google Cloud Storage URLs, the implementation itself permits requests to arbitrary destinations. This may include loopback services, private-network services, link-local addresses, cloud instance metadata endpoints, or attacker-controlled servers reachable from the Agent environment. The output path is also unrestricted. `mkdir -p "$(dirname "$OUTPUT")"` creates the requested parent directory, and `curl -o "$OUTPUT"` replaces or creates any file writable by the Agent. There is no canonical-path validation ensuring the destination remains under `.stitch/designs/`. Downloaded content is not immediately executed by this script. However, writing it over project configuration, source files, shell initialization files, or scripts that a later documented workflow executes could create a secondary code-execution path. ### Attack Path 1. An attacker influences a Stitch/MCP download URL, baton-derived filename, or direct invocation of ...[truncated 1266 chars]- Remediation
View remediation