article-content-extractor-api-skill

• Outcome: Pass
• Latest audit: Sep 5, 2026 · 6:13 PM UTC
• Version: 1.0.0

Overview

This skill is a disclosed BrowserAct article-extraction integration, with no evidence of hidden persistence, local data harvesting, or destructive behavior.

Install only if you are comfortable sending the article URLs you provide to BrowserAct using your BrowserAct API key. Use public article URLs, avoid URLs with private tokens or internal hostnames, and review the broad trigger wording if you want the skill to activate only for article extraction.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence
• Finding: The skill declares runtime requirements including an environment variable and invokes a Python script that necessarily uses network access, but it does not explicitly declare those permissions. This weakens reviewability and least-privilege controls, making it easier for a user or orchestrator to invoke code with broader capabilities than the manifest transparently communicates.

Vague Triggers

Medium

• Confidence: 88% confidence
• Finding: The description is broad enough to match many generic scraping, enrichment, monitoring, comparison, and research requests that are only loosely related to article extraction. Over-broad activation increases the chance an agent will select this skill unexpectedly, causing unnecessary transmission of user-provided URLs or data to an external service and execution of networked code in contexts where the user did not intend it.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The script transmits user-provided article URLs to BrowserAct over an authenticated outbound API call without any explicit notice, consent prompt, or validation of what data is being sent. In a skill context, users may assume local processing, so silently forwarding supplied targets to a third-party service creates a real data-sharing and privacy risk, especially if URLs contain private tokens, internal hostnames, or sensitive query parameters.

Missing User Warnings

Low

• Confidence: 82% confidence
• Finding: The code reads a sensitive API key from the environment and uses it for outbound authentication, but the operational disclosure is incomplete: users are told to provide the key, yet there is no clear warning that it will authenticate requests to a third-party service on their behalf. This is a weaker issue than credential exposure, but it still matters because users may not understand when or how their credential is being used externally.

External Transmission

Medium

• Category: Data Exfiltration

Content

# 1. Start Task
    print("Start Task", flush=True)
    try:
        res = requests.post(
            f"{API_BASE_URL}/templates/{TEMPLATE_ID}/runs",
            json=payload, headers=headers, timeout=30
        ).json()

• Confidence: 95% confidence
• Finding: This line performs the actual external transmission of user-controlled input and authenticated metadata to a third-party API. The behavior is expected for the tool's purpose, but it is still security-relevant because it can disclose sensitive URLs or associated extraction targets to an external processor without guardrails or user awareness.

Static analysis

No suspicious patterns detected.