Security audit

1coos-quickie

Security checks for vulnerabilities and agentic risk

Overview

This URL clipping skill is transparent about its purpose, but it runs mutable third-party code from GitHub and can fetch arbitrary web addresses from the agent's network context.

Review before installing. Use it only if you trust the x-reader GitHub source and are comfortable letting it run locally with your agent user's permissions. Avoid using it on localhost, private-network, cloud-metadata, or sensitive internal URLs unless the environment is sandboxed; a pinned and sandboxed extractor would be safer.

A.I.G

Vulnerability Patterns

Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T03 · Remote Payload Retrieval and Execution

Error

Location: scripts/main.js:47
Finding: Unpinned Remote Code Is Retrieved and Executed at Runtime
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/main.js:6
Finding: Unrestricted URL Fetching Can Reach Internal Network Resources
Content: View full analysis
\[\]\uFF08\uFF09\u3010\u3011\u300C\u300D\u300A\u300B\u3000-\u303F\uFF00-\uFFEF\u4E00-\u9FFF\u3400-\u4DBF\uF900-\uFAFF\u2E80-\u2EFF\u3000-\u303F\uFE30-\uFE4F]+/i; const match = text.match(urlRegex); if (!match) return null; let url = match[0]; url = url.replace(/[.,;:!?'"\uFF09\u300B\u300D\u3011\u3002\uFF0C\uFF1B\uFF1A\uFF01\uFF1F]+$/, ""); while (url.endsWith(")")) { const openParens = (url.match(/$/g) || []).length; const closeParens = (url.match(/$/g) || []).length; if (closeParens > openParens) { url = url.slice(0, -1); } else { break; } } return url; } ``` The resulting URL is forwarded to `x-reader`: ```javascript console.log("Fetching content..."); const fetchResult = await fetchWithXReader(url, config.reader); ``` Inside `fetchWithXReader`, that value is passed as a process argument to the network-capable extractor: ```javascript const args = [ "uvx", "--from", "x-reader[all] @ git+https://github.com/runesleo/x-reader.git", "x-reader", url ]; ``` ### Technical Analysis Validation is limited to finding a string beginning with `http://` or `https://`. The code does not parse and validate the destination against a security policy before handing it to `x-reader`. In particular, it does not reject: - Loopback destinations such as `127.0.0.1` or `[::1]`. - RFC 1918 private networks. - Link-local addresses. - Cloud instance metadata endpoints. - Internal DNS names. - Alternative textual or numeric encodings of restricted IP addresses. - Public des ...[truncated 2004 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The trigger description is very broad, activating whenever a user pastes a URL and expresses common intents like saving, clipping, or extracting content from almost any web page. In an agent environment, this can cause the skill to activate unexpectedly on routine conversation and initiate network access to attacker-controlled URLs or sensitive internal links, increasing SSRF-like and unintended data-handling risk.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 65% confidence
Finding: uvx/uv tool run commands without ==version create a rug-pull risk.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill spawns external commands and runs uvx --from x-reader[all] @ git+https://github.com/runesleo/x-reader.git x-reader <url>, which fetches and executes third-party code from a mutable Git source at runtime. That creates a supply-chain execution path far broader than simple URL clipping: if the upstream repo or dependency chain is compromised, arbitrary code can run with the agent's privileges. The skill context increases risk because handling untrusted URLs is expected, so this execution path is likely to be exercised routinely.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 65% confidence
Finding: uvx/uv tool run commands without ==version create a rug-pull risk.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 65% confidence
Finding: uvx/uv tool run commands without ==version create a rug-pull risk.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 65% confidence
Finding: uvx/uv tool run commands without ==version create a rug-pull risk.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.