Web Fetcher

• Outcome: Pass
• Latest audit: Sep 11, 2026 · 6:34 PM UTC
• Version: 1.2.0

Overview

This web-fetcher is purpose-aligned, but users should avoid using it with private, signed, or token-bearing URLs because it sends URLs to third-party conversion services.

Install only if you are comfortable sending target URLs to r.jina.ai, markdown.new, and defuddle.md. Do not use it for password reset links, signed download URLs, private document shares, API keys in query strings, or pages that require your logged-in browser session unless you intentionally want the agent to inspect that page.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/fetch_url.py:12
• Finding: Disclosure of Sensitive URLs to Third-Party Conversion Services<![CDATA[ ## Vulnerability Details **File Location**: `scripts/fetch_url.py`, lines 12–16 and 33–34 **Vulnerability Type**: Sensitive information exposure through third-party services **Risk Level**: Medium ### Vulnerable Code ```python METHODS = [ ('r.jina.ai', lambda u: f'https://r.jina.ai/http://{u.removeprefix("https://").removeprefix("http://")}'), ('markdown.new', lambda u: f'https://markdown.new/{u}'), ('defuddle', lambda u: f'https://defuddle.md/{u}'), ] ``` The generated URLs are subsequently requested here: ```python for name, builder in METHODS: target = builder(args.url) try: text = fetch(target, args.timeout) ``` ### Technical Analysis The script embeds the complete user-supplied URL into requests sent to as many as three independent external services: `r.jina.ai`, `markdown.new`, and `defuddle.md`. It does not validate, sanitize, or redact URL components before transmission. URLs may contain sensitive information in their query strings, path segments, fragments, or user-information fields. Examples include signed object-storage parameters, password-reset tokens, invitation tokens, API keys, session identifiers, and private document-sharing secrets. When such a URL is supplied, its sensitive components are disclosed to the selected conversion service and may appear in that service's request logs or telemetry. The behavior is consistent with the skill's documented purpose, and there is no evidence that the services are malicious. Nevertheless, silently forwarding complete secret-bearing URLs across additional trust boundaries is an insecure data-handling practice. ### Attack Path 1. A user possesses a private or signed URL that contains an access token or other secret. 2. The user invokes `fetch_url.py` with that URL, or an attacker persuades the user or agent to process it. 3. The script inserts the complete URL into a request to `r.jina.ai`. 4. If that attempt fails or produces blocked or thin content, the sa ...[truncated 824 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Accept only `http` and `https` URLs and reject URLs containing embedded user information. 2. Detect potentially sensitive query parameters such as `token`, `key`, `signature`, `sig`, `auth`, `password`, and common signed-URL parameters. 3. Refuse to forward sensitive URLs by default, or require explicit user confirmation after presenting a redacted warning. 4. Redact secrets from logs, diagnostics, attempt history, and error messages. 5. Provide a direct-fetch mode that retrieves content from the destination without exposing the original URL to conversion services. 6. Clearly document that proxy-based conversion sends the complete URL to third parties. 7. Where practical, allow administrators to configure an approved service allowlist or disable external conversion services entirely. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/fetch_url.py:18
• Finding: Unbounded HTTP Response Buffering Can Exhaust Process Memory<![CDATA[ ## Vulnerability Details **File Location**: `scripts/fetch_url.py`, lines 18–21 **Vulnerability Type**: Uncontrolled resource consumption **Risk Level**: Medium ### Vulnerable Code ```python def fetch(url: str, timeout: int = 30): req = urllib.request.Request(url, headers={'User-Agent': 'Mozilla/5.0'}) with urllib.request.urlopen(req, timeout=timeout) as r: return r.read().decode('utf-8', errors='replace') ``` ### Technical Analysis The call to `r.read()` has no maximum byte count and buffers the entire HTTP response in memory before decoding it. The timeout limits how long individual network operations may wait, but it does not constrain the total number of bytes returned or the amount of memory consumed. A conversion service may return an unexpectedly large response because the original target is large, generates highly repetitive content, or causes abnormal conversion output. A compromised or malfunctioning service could also deliberately return an arbitrarily large body. The script would continue allocating memory until the response ends or the process reaches its memory limit. Decoding the buffered byte string into a Python string may temporarily require additional memory, increasing peak consumption beyond the raw response size. ### Attack Path 1. An attacker supplies or recommends a URL whose converted representation is extremely large. 2. The user or agent invokes `fetch_url.py` with that URL. 3. A configured conversion service returns a very large response body. 4. `r.read()` attempts to buffer the entire response in process memory. 5. The subsequent UTF-8 decoding creates additional memory pressure. 6. The operating system or runtime may terminate the process, or the host may experience degraded availability due to memory exhaustion. ### Impact Assessment Successful exploitation can cause denial of service against the fetch process or the parent agent executing it. If multiple fetches run concurrently, memory press ...[truncated 289 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Define a conservative maximum response size appropriate for expected article content. 2. Read the response incrementally in fixed-size chunks and terminate once the cumulative limit is exceeded. 3. Check `Content-Length` before reading when it is present, while still enforcing the streaming limit because that header may be absent or inaccurate. 4. Return a structured error indicating that the response exceeded the permitted size. 5. Consider limiting the amount of content included in the final JSON output. 6. Apply process- or container-level memory limits as defense in depth. 7. Add tests covering oversized fixed-length responses, chunked responses, and responses that omit `Content-Length`. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence
• Finding: The skill instructs network-based retrieval from multiple external services and browser/search fallbacks, but it does not declare any explicit tool scope, permissions, or allowed-tools boundary. That mismatch can cause the runtime or orchestrator to grant broader network access than users expect, increasing the risk of unintended outbound requests, data exfiltration via fetch targets, or use of unreviewed retrieval paths.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The script fetches arbitrary user-supplied URLs and relays the retrieved content through third-party proxy services without any validation, restriction, or disclosure. In an agent setting, this can enable SSRF-style access to internal resources, unexpected transmission of sensitive URLs to external services, and retrieval of untrusted content from destinations the user may not realize are being contacted.

Static analysis

No suspicious patterns detected.