T08 · Insecure Dependencies
Warning
- Location
SKILL.md:140- Finding
Unpinned Third-Party Package Is Downloaded and Executed Automatically
- Content
View full analysis
- Remediation
View remediation
Security audit
website-cloner 网站1:1本地复刻
Security checks for vulnerabilities and agentic risk
Overview
The skill is a website-cloning guide with disclosed local-copy behavior, but it includes attribution replacement, unsafe shell examples, and unpinned remote package execution that need human review before use.
Install only if you will use it for sites you own or have permission to copy. Before running it, pin or preinstall any browser automation dependency instead of using @latest, validate and quote target URLs, run in a limited workspace without secrets, and preserve attribution unless you are authorized to change it.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)
T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:62- Finding
Unquoted User-Supplied URL Can Enable Shell Command Injection
- Content
View full analysis
/ curl -sL --max-time 15 -o app.css /app.css curl -sL --max-time 15 -o app.js /app.js # Download all token files when styles.css is an @import entry point curl -sL --max-time 15 -o tokens/fonts.css /tokens/fonts.css curl -sL --max-time 15 -o tokens/colors.css /tokens/colors.css curl -sL --max-time 15 -o tokens/typography.css /tokens/typography.css curl -sL --max-time 15 -o tokens/spacing.css /tokens/spacing.css # Download font curl -sL --max-time 15 -o fonts/brand-medium.otf /fonts/brand-medium.otf # Download favicon, logo, and Open Graph image curl -sL --max-time 15 -o assets/logo.png /assets/logo.png curl -sL --max-time 15 -o assets/favicon-32.png /assets/favicon-32.png ``` The initial reconnaissance command contains the same unsafe substitution pattern: ```bash curl -sL -o /tmp/site_index.html -w "HTTP %{http_code} Size %{size_download}" --max-time 15 ``` ### Technical Analysis The `` placeholder represents input that will ordinarily originate from the user requesting a website clone. The documented commands insert that value directly into shell command text without quoting, syntactic validation, or an option terminator. If an Agent performs textual substitution and passes the resulting command to a shell, metacharacters such as semicolons, command substitutions, pipes, redirections, or logical operators may be interpreted as shell syntax rather than as part of the URL. Quoting alone is insufficient if the substitution mechanism itself constructs a shell command unsafely; the URL should first be parsed and validated and then passed as a distinct process argument. A value beginning ...[truncated 1708 chars]- Remediation
View remediation
Vulnerability Patterns
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (10)
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The skill encourages cloning arbitrary websites and includes attribution-rewriting behavior without any warning about authorization, copyright, trademark, or ownership constraints. In context, this omission materially increases misuse risk because the workflow is framed as a straightforward method to recreate and rebrand third-party sites.
- Content
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The skill explicitly instructs users to replace the original author's name and external profile links after cloning a site. That goes beyond technical mirroring and facilitates impersonation, plagiarism, and deceptive redistribution of third-party content under altered identity.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill's natural-language instructions, headings, triggers, and examples are all in Chinese, effectively forcing a specific language for use and interpretation. There is no opt-in, alternative language, or stated regional justification for this locale constraint.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The procedure downloads multiple remote resources via curl and writes them into a local directory structure, but the markdown does not prominently disclose this data transfer and local storage behavior as a user warning. Because the skill operates on arbitrary websites and recursively pulls assets, users should be warned that content and metadata from remote systems will be copied onto their machine.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 81% confidence
- Finding
The skill's purpose is local website cloning, but Step 6 adds execution of
npx ... agent-browser@latestand optional vision-model analysis. With no manifest scoping available, these extra capabilities introduce remote package execution and AI-based inspection that are not inherent to producing a local mirror.- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 96% confidence
- Finding
The skill instructs users to run
npx -y agent-browser@latest, which fetches and executes the latest package version at runtime without pinning or integrity verification. This creates a supply-chain risk: a compromised upstream release or dependency could execute arbitrary code on the user's machine during validation steps.- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 96% confidence
- Finding
This invocation again relies on
npx -y agent-browser@latest, causing unpinned remote code execution as part of the workflow. Because the skill positions this as a normal verification step, it increases the chance users will run arbitrary updated code without review.- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 96% confidence
- Finding
The command fetches and runs the latest
agent-browserpackage directly from npm, exposing the user to package takeover, malicious updates, or dependency compromise. Repeating the pattern across multiple commands normalizes insecure execution and broadens the attack surface.- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 95% confidence
- Finding
The tooling section recommends
npx -y agent-browser@latestas the installation method, embedding an insecure supply-chain practice into the skill itself. Users following the documented setup may unknowingly execute arbitrary upstream code outside any pinned or audited environment.- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 83% confidence
- Finding
The manifest display name includes Chinese text ("网站1:1本地复刻") alongside English, but there is no indication that the skill is bilingual by user choice or limited to a Chinese-language audience. This can violate language/locale policy expectations when a skill implicitly imposes or assumes a language without opt-in or documented scope.
- Content
Static analysis
No suspicious patterns detected.