webpage-reader-skill

• Outcome: Review
• Latest audit: Sep 11, 2026 · 9:14 PM UTC
• Version: 0.0.2

Overview

This webpage-reading skill is mostly coherent, but it can make privileged system changes and fetch arbitrary URLs with an unsandboxed browser during normal use.

Review before installing. Use this only in an isolated environment with no access to sensitive internal networks, metadata endpoints, or local services, and do not run it with sudo-capable privileges. Preinstall Chrome manually through a trusted admin process rather than allowing the skill to install packages at runtime.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T09 · Insecure Skill Coding Practices

Error

• Location: webpage_reader.py:124

Finding

Unrestricted URL Fetching Enables Server-Side Request Forgery

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: webpage_reader.py:128

Finding

Headless Chrome Processes Untrusted Pages with Its Sandbox Disabled

Content

View full analysis

Remediation

View remediation

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: webpage_reader.py:78

Finding

Normal Skill Execution Can Trigger Privileged System Package Installation

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import

Findings (18)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The README states that Chrome may be installed automatically, but it does not clearly warn users that running the skill can modify the host system by installing software and invoking package managers. In an agent-skill context, undocumented system modification is security-relevant because users may grant execution assuming the skill is read-only, which can lead to unexpected package installation and trust-boundary violations.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The README explicitly advertises automatic Chrome installation and webpage downloading, which implies both system modification and outbound network access, but it does not clearly warn users about those behaviors before use. In a skill context, undisclosed package installation and network retrieval increase the risk of unexpected changes to the host and accidental use in restricted or sensitive environments.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill documentation describes downloading and analyzing webpages but does not clearly warn users that arbitrary external URLs will be contacted, causing network requests to be sent to third-party sites. In an agent/skill context, this can lead to unintended data disclosure, SSRF-like access to internal resources, or privacy risks if users provide sensitive or internal URLs without understanding the network impact.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The documentation notes that Chrome may be automatically installed, but it does not sufficiently emphasize that this changes the local system by installing software and potentially invoking package managers with elevated privileges. In an agent environment, automatic dependency installation increases supply-chain and system-integrity risk, especially if users do not expect software installation as part of normal skill execution.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The documentation claims the skill only downloads webpage content, but the implementation also installs Chrome and invokes system package managers. This mismatch is security-relevant because it conceals host-modifying behavior from reviewers and users, undermining informed consent and making dangerous side effects easier to smuggle into agent workflows.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · webpage_reader.py (reported line 47)May include surrounding context.

python

return False
        else:
            # For macOS and Linux, use which command
            result = subprocess.run(
                ['which', 'google-chrome'] if platform.system() != 'Darwin' else ['which', 'chrome'],
                capture_output=True,
                text=True

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 88% confidence

Finding

This code performs software installation as a side effect of a webpage-reading skill, which exceeds the declared functionality and modifies the host environment. Even with fixed arguments, auto-installing software can introduce unreviewed system changes, supply-chain exposure, and unexpected privilege escalation paths depending on how the skill is executed.

Content

Scanner excerpt · webpage_reader.py (reported line 78)May include surrounding context.

python

elif system == 'Darwin':  # macOS
            # macOS installation using Homebrew
            try:
                subprocess.run(['brew', 'install', 'google-chrome'], check=True)
                return True
            except subprocess.CalledProcessError:
                logger.error("Homebrew not found. Please install Homebrew first or manually install Chrome.")

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 97% confidence

Finding

Running 'sudo apt-get update' from a content-processing skill causes privileged system modification without interactive confirmation or clear operator consent. In an agent context, this is dangerous because a simple request to read a webpage can unexpectedly trigger privileged package-manager activity and broaden the attack surface through repository trust and dependency changes.

Content

Scanner excerpt · webpage_reader.py (reported line 88)May include surrounding context.

python

distro = platform.dist()[0].lower() if hasattr(platform, 'dist') else 'unknown'
            
            if 'ubuntu' in distro or 'debian' in distro:
                subprocess.run(['sudo', 'apt-get', 'update'], check=True)
                subprocess.run(['sudo', 'apt-get', 'install', '-y', 'google-chrome-stable'], check=True)
                return True
            elif 'fedora' in distro or 'centos' in distro or 'rhel' in distro:

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

Automatic package installation via sudo without explicit warning or approval is a genuine security issue in an agent skill. It can perform privileged changes on the host merely because a user asked to read a webpage, violating least surprise and enabling dangerous environment drift or abuse if the skill is invoked in sensitive systems.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 98% confidence

Finding

This call attempts to install Chrome system-wide with sudo, which is a high-risk side effect for a webpage downloader. It can change the host state, pull packages from external repositories, and may execute with elevated privileges in environments where the agent already has broad access.

Content

Scanner excerpt · webpage_reader.py (reported line 89)May include surrounding context.

python

if 'ubuntu' in distro or 'debian' in distro:
                subprocess.run(['sudo', 'apt-get', 'update'], check=True)
                subprocess.run(['sudo', 'apt-get', 'install', '-y', 'google-chrome-stable'], check=True)
                return True
            elif 'fedora' in distro or 'centos' in distro or 'rhel' in distro:
                subprocess.run(['sudo', 'dnf', 'install', '-y', 'google-chrome-stable'], check=True)

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 97% confidence

Finding

This privileged package installation on RPM-based systems has the same risk profile as the apt-based path: unexpected host modification, supply-chain exposure, and possible privilege misuse. The danger is amplified because the skill's stated purpose does not justify package-manager execution.

Content

Scanner excerpt · webpage_reader.py (reported line 92)May include surrounding context.

python

subprocess.run(['sudo', 'apt-get', 'install', '-y', 'google-chrome-stable'], check=True)
                return True
            elif 'fedora' in distro or 'centos' in distro or 'rhel' in distro:
                subprocess.run(['sudo', 'dnf', 'install', '-y', 'google-chrome-stable'], check=True)
                return True
            else:
                logger.error("Unsupported Linux distribution. Please manually install Chrome.")

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 93% confidence

Finding

This subprocess call launches a full headless browser against an attacker-controlled URL, which creates meaningful risk beyond a normal HTTP fetch. A remote page can trigger browser-level exploitation, internal network access/SSRF-like behavior from the host, and excessive resource consumption; the use of '--no-sandbox' materially increases the impact of any browser compromise.

Content

Scanner excerpt · webpage_reader.py (reported line 134)May include surrounding context.

python

logger.info(f"Running Chrome command: {' '.join(chrome_cmd)}")
        
        # Execute the command and capture output
        result = subprocess.run(
            chrome_cmd,
            capture_output=True,
            text=True,

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The main function is described as webpage processing, but it can trigger system-wide dependency installation as part of normal execution. In an agent skill, this hidden side effect is dangerous because downstream orchestrators may treat it as a read-only capability when it actually performs administrative changes.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 78% confidence

Finding

文档内容全部以中文呈现，没有说明这是面向特定中文用户群体，也没有提供其他语言选项或用户可选择语言的提示。按照语言/locale政策，若强制单一语言且无明确限定或用户选择，可能构成自然语言策略问题。

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

The README describes downloading and analyzing arbitrary webpages but does not clearly warn that the skill will make outbound network requests and retrieve remote content. In an agent environment, this can expose user IP, trigger access to sensitive/internal URLs if misused, and create privacy or SSRF-like risk if operators assume the skill is local-only.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 74% confidence

Finding

整个技能文档仅以中文呈现，未说明这是面向特定中文用户群的区域性技能，也未提供语言选择或英文替代。根据语言/区域政策，若技能对语言有实际约束，应提供用户选择或明确且合理的限制说明。

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The manifest explicitly states that the skill downloads webpage content and returns that content, but it does not provide any user-facing warning about outbound network access, what remote data is fetched, or that fetched content may be transmitted back into the agent workflow. This is a real transparency and consent issue: users may invoke the skill without understanding that arbitrary URLs can be contacted and remote content ingested, which can expose internal browsing targets, sensitive query parameters, or untrusted prompt-bearing content.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The download function launches Chrome headlessly against the supplied URL, which causes external network access and transmission of request metadata such as IP, user agent, and possibly ambient browser behavior. The code states it downloads webpage content, but it does not present a specific warning or confirmation around contacting third-party sites.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.