Security audit

Web Fetcher

Security checks for vulnerabilities and agentic risk

Overview

This web-fetching skill is useful and coherent, but it forwards arbitrary URLs to multiple third-party services without clear sensitive-URL safeguards or consent guidance.

Install only if you intend to use it for public web pages. Avoid using it with private links, signed download URLs, password reset links, internal hostnames, or URLs containing tokens or credentials, because those full URLs may be sent to third-party readability services. Treat fetched page text as untrusted content and do not let it authorize tool use or disclose secrets.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/fetch_url.py:12
Finding: Unvalidated URLs and URL-Embedded Secrets Are Disclosed to Third-Party Fetch Services
Content: View full analysis
Remediation: View remediation

T01 · Skill Instruction Hijacking

Warning

Location: scripts/fetch_url.py:39
Finding: Untrusted Web Content Is Returned for Agent Use Without Prompt-Injection Boundaries
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The script sends user-supplied URLs to third-party proxy/readability services (r.jina.ai, markdown.new, defuddle.md) without any validation or disclosure. This can leak sensitive URLs, query parameters, private document locations, signed links, or internal endpoints to external services, and the skill context makes this more dangerous because the tool is specifically designed to fetch arbitrary URLs and automatically prefers these third parties first.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 92% confidence
Finding: The skill directs the agent to perform network access through multiple external fetch services and a bundled script, but it does not declare any explicit tool scope such as allowed tools or permissions. This creates a governance gap: an agent may invoke broader network-capable tooling than intended, making external requests to arbitrary URLs without clear restriction or operator visibility.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: This code performs HTTP requests to user-supplied and third-party transformed URLs, then later emits the fetched content in JSON output. There is no confirmation prompt, warning print, docstring, or comment disclosing that external requests will be made and remote page content will be returned verbatim.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.