Tinyfish Fetch

• Outcome: Review
• Latest audit: Sep 16, 2026 · 6:45 AM UTC
• Version: 1.0.0

Overview

This skill does what it says, but it sends user-provided URLs to TinyFish and exposes the TinyFish API key in local curl process arguments.

Install only if you are comfortable sending requested URLs and rendered page content to TinyFish. Avoid internal, private, regulated, or token-bearing URLs unless your organization approves that data flow, and prefer changing the helper to pass the API key through a protected curl config or file descriptor instead of command-line arguments.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/fetch.sh:61

Finding

TinyFish API Key Exposed Through Process Command-Line Arguments

Content

View full analysis

Vulnerability Details

File Location: scripts/fetch.sh:61-64
Related Documentation: SKILL.md:27-30
Vulnerability Type: API credential exposure through process arguments
Risk Level: Medium

Vulnerable Code

scripts/fetch.sh:61-64:

bash

exec curl -s -X POST "https://api.fetch.tinyfish.ai" \
  -H "X-API-Key: ${TINYFISH_API_KEY}" \
  -H "Content-Type: application/json" \
  -d "$BODY"

SKILL.md:27-30 documents the same insecure pattern:

bash

curl -X POST "https://api.fetch.tinyfish.ai" \
  -H "X-API-Key: $TINYFISH_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{

Technical Analysis

The shell expands TINYFISH_API_KEY before starting curl. Consequently, the complete authentication header, including the secret API key, is placed in the curl process argument vector.

On systems where process command lines are visible to other users, privileged monitoring agents, diagnostic utilities, or process-accounting systems, the credential may be recovered while the request is running. Potential observation mechanisms include process-listing utilities and operating-system process metadata.

Transmitting the API key to the documented TinyFish HTTPS endpoint is necessary for the Skill's declared functionality. Exposing the key through local command-line arguments is not necessary and exceeds the minimum information exposure required to authenticate the request.

No evidence was found that the Skill intentionally sends the key to an unrelated endpoint. The destination is statically set to the documented https://api.fetch.tinyfish.ai service.

Attack Path

1. A victim configures TINYFISH_API_KEY and invokes scripts/fetch.sh.
2. The shell expands the environment variable inside the -H argument.
3. The resulting curl process contains X-API-Key: <secret> in its argument vector.
4. An attacker or monitoring component with sufficient local pro ...[truncated 867 chars]

Remediation

View remediation

Remediation Suggestions

Avoid placing secret-bearing headers directly in command-line arguments.

1. Supply the authentication header through a protected curl configuration stream, file descriptor, or temporary configuration file rather than through -H on the command line.
2. If a temporary file is used:
   • Create it with permissions restricted to the current user, such as 0600.
   • Use a securely generated unpredictable path, for example through mktemp.
   • Register a cleanup trap so the file is removed on normal exit, errors, and signals.
   • Do not place it in a shared location with permissive access.
3. Ensure debugging and shell tracing are disabled around all credential handling so the key is not written to logs.
4. Update the example in SKILL.md so users are not instructed to reproduce the vulnerable command-line pattern.
5. Rotate any API key suspected of having appeared in process listings, diagnostic captures, or process-accounting logs.
6. Where supported by TinyFish, use narrowly scoped credentials, usage limits, expiration, and key-rotation policies to reduce the impact of disclosure.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (5)

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 96% confidence

Finding

The skill invokes shell commands (curl and a helper script) but does not declare any tool scope or allowed tools, so an agent/runtime may permit broader shell access than users expect. This weakens least-privilege controls and makes misuse or accidental command execution harder to constrain.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The documentation does not clearly warn that user-supplied URLs and the fetched page contents are transmitted to TinyFish, a third-party service. Users may unknowingly send sensitive internal URLs, tokens in query strings, or confidential page data off-platform, creating privacy, compliance, and data-handling risk.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 89% confidence

Finding

The skill explicitly posts user-provided URLs to an external service and authenticates with an API key, which is an external data transmission path by design. In this context the behavior is expected, but it is still security-relevant because fetched targets and returned content may contain sensitive information, and the proxy/rendering feature can increase exposure to third-party processing.

Content

Scanner excerpt · SKILL.md (reported line 29)May include surrounding context.

Basic Fetch

bash

curl -X POST "https://api.fetch.tinyfish.ai" \
  -H "X-API-Key: $TINYFISH_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 70% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/fetch.sh (reported line 63)May include surrounding context.

sh

BODY=$(python3 -c "import json,sys; print(json.dumps({'urls': json.loads(sys.argv[1]), 'format': sys.argv[2]}))" "$URLS_JSON" "$FORMAT")
fi

exec curl -s -X POST "https://api.fetch.tinyfish.ai" \
  -H "X-API-Key: ${TINYFISH_API_KEY}" \
  -H "Content-Type: application/json" \
  -d "$BODY"

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

This code performs an HTTP POST to an external service and transmits the collected URL list, format, and optional country value, but the script provides no confirmation prompt or explicit disclosure that input data will be sent off-host. The header comment identifies it as an API helper, yet it does not clearly warn users that supplied targets are transmitted to a third-party endpoint.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.