Security audit

Wine Info Search

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly a read-only wine lookup tool, but its optional Firecrawl path can retry an authenticated request with TLS certificate checks disabled, which could expose the API key on a hostile network.

Review before installing if you plan to use Firecrawl. Do not use this version with a Firecrawl API key on untrusted or intercepted networks unless the TLS retry is removed or fixed, and rotate any key used during certificate failures or suspicious timeouts. Treat the health guidance as general information, not medical advice.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Error

Location: scripts/wine_search.py:123
Finding: Firecrawl bearer token retransmitted with TLS certificate verification disabled
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Note

Location: scripts/requirements.txt:8
Finding: Optional OCR dependencies are installed without artifact integrity verification
Content: View full analysis
Remediation: View remediation
`. 3. Include all transitive dependencies in the lock file rather than hashing only the three direct requirements. 4. Generate separate lock files when different operating systems or Python versions require different artifacts. 5. Document the trusted package index explicitly and avoid unreviewed third-party mirrors. 6. Install optional OCR dependencies only when image recognition is required. 7. Consider isolating OCR processing in a restricted virtual environment or sandbox with minimal filesystem and network access. 8. Periodically regenerate and review the lock file when dependencies are intentionally upgraded. ]]>

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (53)

Tainted flow: 'req' from os.environ.get (line 879, credential/environment) → urllib.request.urlopen (network output)

Critical

Category: Data Flow
Confidence: 97% confidence
Finding: Firecrawl requests include an Authorization bearer token derived from FIRECRAWL_API_KEY and are sent over the network. In this helper, SSL verification failures and timeouts can trigger logic that ultimately permits a retry path with certificate validation disabled elsewhere in the same Firecrawl flow, making the token exposable to MitM interception despite the comments claiming safety.
Content: Scanner excerpt · scripts/wine_search.py (reported line 123)May include surrounding context.
python
4. The bearer token is already transmitted over the same HTTPS connection """ try: return urllib.request.urlopen(req, context=_ssl_ctx, timeout=timeout) except (ssl.SSLCertVerificationError, urllib.error.URLError, TimeoutError, OSError) as e: # Check if it's an SSL verification error or a timeout that might be # caused by SSL handshake issues (common in restricted network environments)

Tainted flow: 'req' from os.environ.get (line 879, credential/environment) → urllib.request.urlopen (network output)

Critical

Category: Data Flow
Confidence: 100% confidence
Finding: This line explicitly retries a Firecrawl API request carrying an Authorization bearer token using an SSL context with hostname checks disabled and verify_mode=CERT_NONE. That allows an active network attacker to impersonate api.firecrawl.dev, intercept the API key, and tamper with scraped responses.
Content: Scanner excerpt · scripts/wine_search.py (reported line 141)May include surrounding context.
python
setattr(insecure_ctx, "check_hostname", False) setattr(insecure_ctx, "verify_mode", getattr(ssl, "CERT_NONE")) try: return urllib.request.urlopen(req, context=insecure_ctx, timeout=timeout) except Exception: pass # Fall through to raise original error

Tainted flow: 'req' from os.environ.get (line 879, credential/environment) → urllib.request.urlopen (network output)

Critical

Category: Data Flow
Confidence: 90% confidence
Finding: Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.
Content: Scanner excerpt · scripts/wine_search.py (reported line 158)May include surrounding context.
python
is used directly without any fallback logic. """ try: return urllib.request.urlopen(req, context=_ssl_ctx, timeout=timeout) except (ssl.SSLCertVerificationError, urllib.error.URLError) as e: if isinstance(e, ssl.SSLCertVerificationError) or \ (isinstance(e, urllib.error.URLError) and isinstance(e.reason, ssl.SSLCertVerificationError)):

Tp4

High

Category: MCP Tool Poisoning
Confidence: 93% confidence
Finding: Accepting a Firecrawl credential and using an external scraping/proxy service is a stronger capability than a simple local search/display skill description suggests. Even if the API key is optional, the current wording can cause users and platforms to misclassify the skill's trust requirements and data-flow exposure.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 91% confidence
Finding: Accepting a Firecrawl credential and using an external scraping/proxy service is a stronger capability than a simple local search/display skill description suggests. Even if the API key is optional, the current wording can cause users and platforms to misclassify the skill's trust requirements and data-flow exposure.
Content: No source excerpt is available for this finding.

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 100)May include surrounding context.
md
python scripts/wine_search.py "Lafite" --firecrawl-key fc-xxxx

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 126)May include surrounding context.
md
python scripts/wine_search.py "Lafite" --firecrawl-key fc-xxxx

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 127)May include surrounding context.
md
python scripts/wine_search.py "Lafite" --firecrawl-key fc-xxxx

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 142)May include surrounding context.
md
python scripts/wine_search.py "Lafite" --firecrawl-key fc-xxxx

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 143)May include surrounding context.
md
python scripts/wine_search.py "Lafite" --firecrawl-key fc-xxxx

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 159)May include surrounding context.
md
python scripts/wine_search.py "Lafite" --firecrawl-key fc-xxxx

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 160)May include surrounding context.
md
python scripts/wine_search.py "Lafite" --firecrawl-key fc-xxxx

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 169)May include surrounding context.
md
python scripts/wine_search.py "Lafite" --firecrawl-key fc-xxxx

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 192)May include surrounding context.
md
python scripts/wine_search.py "Lafite" --firecrawl-key fc-xxxx

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 223)May include surrounding context.
md
python scripts/wine_search.py "Lafite" --firecrawl-key fc-xxxx

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 224)May include surrounding context.
md
python scripts/wine_search.py "Lafite" --firecrawl-key fc-xxxx

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 225)May include surrounding context.
md
python scripts/wine_search.py "Lafite" --firecrawl-key fc-xxxx

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 243)May include surrounding context.
md
python scripts/wine_search.py "Lafite" --firecrawl-key fc-xxxx

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 244)May include surrounding context.
md
python scripts/wine_search.py "Lafite" --firecrawl-key fc-xxxx

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 245)May include surrounding context.
md
python scripts/wine_search.py "Lafite" --firecrawl-key fc-xxxx

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 246)May include surrounding context.
md
python scripts/wine_search.py "Lafite" --firecrawl-key fc-xxxx

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 247)May include surrounding context.
md
python scripts/wine_search.py "Lafite" --firecrawl-key fc-xxxx

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 248)May include surrounding context.
md
python scripts/wine_search.py "Lafite" --firecrawl-key fc-xxxx

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 249)May include surrounding context.
md
python scripts/wine_search.py "Lafite" --firecrawl-key fc-xxxx

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The skill expands from wine lookup into personalized health and drinking advice, including age bands, medical conditions, and consumption limits. This creates out-of-scope medical guidance and can cause harm if users rely on inaccurate or overly generalized recommendations, especially for pregnancy, liver disease, medication interactions, or chronic illness.
Content: No source excerpt is available for this finding.