I Found 3 Security Vulnerabilities in My Own AI Agent's Tool Access

说明与用途

在为 OpenAI WebMCP 挑战创建的 GeoMart 项目中，发现了三处漏洞：未转义的 HTML、未受保护的报价创建端点以及弱 Origin 检查。通过添加 Cloudflare Turnstile 并执行缺失的数据库迁移，所有攻击均已被阻止。

问题

An AI‑agent‑driven storefront exposed three security flaws: unescaped HTML, an unprotected quote‑creation endpoint, and a weak Origin‑based check that could be bypassed by non‑browser scripts.

结果

All identified vulnerabilities were mitigated, the quote creation flow now requires a genuine browser interaction and a valid Turnstile token, and the database migration was applied, restoring full functionality.

工作流

• 1. Run Antigravity against the repo to identify vulnerabilities.
• 2. Fix unescaped innerHTML by escaping all agent‑supplied strings before insertion.
• 3. Add an isTrusted check to the submit button’s click handler to prevent script‑simulated clicks.
• 4. Implement an Origin header check, then discover it can be spoofed via Node fetch.
• 5. Replace Origin check with Cloudflare Turnstile, storing the secret in a Worker secret and verifying server‑side.
• 6. Run Antigravity again to confirm all attacks are blocked.
• 7. Identify missing database migration and execute it to enable quote persistence.
• 8. Deploy updated code and monitor for 403/500 responses.

证据

Antigravity's first pass found that agent-supplied text, the quote reasoning, the product IDs in the comparison tray, was going straight into the page via unescaped innerHTML.

来源

I added Cloudflare Turnstile, verified server-side against a secret stored only in a Worker secret, never committed, never in the client bundle.

来源

The database table for storing submitted quotes had never been created.

来源