Security audit

Deadlink

Security checks for vulnerabilities and agentic risk

Overview

DeadLink is a straightforward link checker that discloses its network checks and local report creation, with normal caution needed around untrusted URLs.

Install only if you are comfortable with the skill making outbound web requests for URLs you provide or scan. Do not run it against untrusted files or pages in environments where requests to localhost, private networks, or cloud metadata services would be sensitive. Reports are saved as plain text in the current directory.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/script.sh:45
Finding: Unrestricted URL Fetching Enables Server-Side Request Forgery
Content: View full analysis
/dev/null || echo "000") echo "$code" } ``` The redirect-inspection request is also unrestricted: ```bash redirect_url=$(curl -sL -o /dev/null -w '%{url_effective}' \ --max-time "$TIMEOUT" -A "$USER_AGENT" "$url" 2>/dev/null || echo "(unknown)") ``` The site-crawling command fetches its user-supplied target in the same manner: ```bash page_content=$(curl -sL --max-time 15 -A "$USER_AGENT" "$url" 2>/dev/null || echo "") ``` ### Technical Analysis The `check` and `site` commands accept user-controlled URLs and pass them directly to `curl`. URLs extracted from attacker-influenced files or web pages are also eventually processed by `check_url`. The implementation does not validate the URL scheme, destination hostname, resolved IP address, or network range before initiating a request. The `-L` option instructs `curl` to follow HTTP redirects automatically. Consequently, validating only an initial public hostname would not be sufficient: an attacker-controlled public endpoint can redirect the request to a loopback, private, link-local, or cloud metadata address. No validation is performed on redirect destinations. Potential targets include: - Loopback services such as `127.0.0.1` or `[::1]` - Private network ranges such as `10.0.0.0/8` and `192.168.0.0/16` - Link-local services such as `169.254.169.254` - Internal DNS hostnames accessible from the execution environment - Internal administrative or monitoring endpoints The req ...[truncated 2132 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 85% confidence
Finding: The skill describes shell-capable behavior (curl, file/report generation, crawling) but does not declare any explicit tool scope such as permissions or allowed-tools. This creates an authorization gap where an agent may invoke broader shell functionality than a reviewer expects, increasing the risk of unintended command execution, filesystem writes, or network access beyond the narrow link-checking use case.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 85% confidence
Finding: The script creates and writes a timestamped report file in the current working directory via redirection to "$report_file". Although this behavior is part of the report command's functionality, the code path itself lacks a confirmation prompt or upfront disclosure comment/docstring warning that a new file will be created.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.