MarsEdge ProbBoard

• Outcome: Review
• Latest audit: Sep 16, 2026 · 7:45 AM UTC
• Version: 1.0.0

Overview

This skill mostly does what it claims, but its fetch script can be pointed at arbitrary URLs, so it needs review before installation.

Install only if you are comfortable with a skill that makes live network requests for market data. Keep use limited to the default MarsEdge endpoint, avoid passing custom base URLs, and treat its trading-style summaries as informational rather than financial advice.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/fetch-board.mjs:3

Finding

Unrestricted Base URL Enables Server-Side Request Forgery

Content

View full analysis

Vulnerability Details

File Location: scripts/fetch-board.mjs, lines 3–7
Vulnerability Type: Server-Side Request Forgery through an unvalidated command-line URL
Risk Level: Medium

Vulnerable Code

js

const baseUrl = (process.argv[2] || 'https://marsedge.vip').replace(/\/$/, '');
const url = `${baseUrl}/api/probboard/latest`;

try {
  const res = await fetch(url, {

Technical Analysis

The script permits its first command-line argument to determine the request origin without validating the URL scheme, hostname, resolved IP address, embedded credentials, or destination network range. Node.js fetch also follows HTTP redirects by default.

An attacker who can influence the argument can therefore cause the runtime to issue a request to an attacker-selected host, including potentially localhost, private-network services, or link-local infrastructure. An attacker-controlled endpoint could also redirect the request to another destination.

The script reads the entire response using res.text(). If the response is not JSON, up to 500 characters are included in error output. Valid JSON error responses may be emitted through the data field. This creates a limited channel through which content obtained from an unintended destination can become visible in script or agent output. Reading the response without a size limit also exposes the process to memory exhaustion from an oversized response.

Attack Path

1. An attacker directly supplies, or persuades an agent or operator to supply, a malicious base URL as the first command-line argument.
2. The script appends /api/probboard/latest and sends a request to that origin.
3. The supplied server may respond directly or redirect the request toward a localhost, private-network, or link-local service.
4. The script reads the destination's response without a response-size limit.
5. Depending on the response format and status, response content is printed in an error object or processed as ...[truncated 772 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove the base URL override if requests are only intended for marsedge.vip.
2. If configurability is required, parse the input with URL and enforce:
   • The https: protocol.
   • An explicit allowlist of approved hostnames.
   • No embedded username or password.
   • The expected port or a narrow allowlist of ports.
3. Resolve the hostname and reject loopback, private, link-local, multicast, reserved, and cloud-metadata address ranges for both IPv4 and IPv6. Repeat destination validation when establishing the connection to reduce DNS rebinding risk.
4. Disable automatic redirects with redirect: 'manual', or validate the scheme, hostname, port, and resolved address of every redirect target before following it.
5. Add an AbortSignal timeout to prevent slow or stalled requests from tying up the process.
6. Stream the response while enforcing a strict byte limit instead of calling res.text() on an unbounded body.
7. Avoid printing arbitrary response bodies. Return a fixed error message or a tightly sanitized and size-limited diagnostic.
8. Validate the expected response schema and field types before emitting the resulting JSON.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (3)

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 94% confidence

Finding

The skill instructs the agent to execute a network-capable script against a live external endpoint but does not declare any tool scope or permissions in the manifest. This creates an authorization and transparency gap: the runtime may permit network access without the skill explicitly constraining or documenting it, increasing the chance of unintended external requests or abuse if the skill is invoked broadly.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The description uses broad trigger phrases like 'quick board summary,' 'strongest coin,' and 'simple watchlist-style observations,' which can match common market-analysis requests and cause over-invocation. Because the skill performs live fetching from an external service, overly broad routing increases the chance that unrelated user requests trigger network activity or that users receive niche/proprietary market output when they asked for general analysis.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The only concrete output example is written in Chinese, which implicitly steers the skill toward a specific language choice. There is no statement offering language selection or limiting this to a region-specific use case, creating a natural-language policy issue for locale handling.

Content

No source excerpt is available for this finding.