X Article Extractor

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 4:40 AM UTC
• Version: 1.0.0

Overview

This skill is a straightforward X article extractor, but users should treat its package install and browser downloads as normal third-party code execution risk.

Install only in an environment where outbound network access and third-party Python/browser code execution are acceptable. For stronger control, pin and verify the package and browser dependencies or run the extractor in a sandbox with minimal filesystem access and no unnecessary secrets.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:18

Finding

Unpinned Third-Party Package and Automatic Browser Binary Downloads

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 18–25
Vulnerability Type: Unverified and unpinned third-party dependencies
Risk Level: Medium

Evidence

markdown

## Prerequisites & Installation

The tool manages its own browser dependencies. Simply install the package:

```sh
pip install omni-article-markdown

> Important (First Run Only): The Playwright engine and Chromium core are lazy-loaded. They will be automatically downloaded and configured during the first execution. Expect a significant delay (1-3 minutes depending on bandwidth) during the initial run. Subsequent runs will be near-instant.

text

The documented command is subsequently invoked as follows at lines 43–46:

```sh
# Basic command
mdcli https://x.com/elonmusk/status/1234567890

Technical Analysis

The skill instructs the agent to install omni-article-markdown from the default Python package index without an exact version constraint or cryptographic hash. Consequently, the artifact installed during a future skill run may differ from the artifact that existed when this skill was reviewed.

The installed command also performs lazy retrieval and configuration of Playwright and Chromium components during first execution. The document specifies neither fixed browser versions nor checksums, approved download origins, signature validation, or a dependency lock file. This expands the trust chain from the reviewed skill text to a mutable package release and additional remotely downloaded artifacts.

If the package publisher account, package-index release, dependency chain, or browser binary distribution channel is compromised, attacker-controlled installation hooks or runtime code could execute under the agent's operating-system identity. The linked GitHub repository does not, by itself, cryptographically prove that the package-index artifact was built from the reviewed source.

This finding is limit ...[truncated 1537 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin omni-article-markdown to a reviewed, immutable version rather than installing the latest available release.
2. Install from a lock file with cryptographic hashes, such as a hash-locked requirements file used with pip --require-hashes.
3. Pin Playwright, Chromium, and all transitive dependencies to reviewed versions.
4. Verify downloaded browser artifacts using publisher signatures or documented SHA-256 checksums before installation or execution.
5. Restrict package and browser downloads to approved, authenticated repositories or mirrors.
6. Verify package provenance and ensure the distributed package corresponds to a reviewed source commit and reproducible build.
7. Disable automatic first-run component retrieval where practical; provision verified browser components during a controlled build stage instead.
8. Execute the extractor inside a sandbox or container with minimal filesystem access, no unnecessary secrets, restricted network egress, and a non-privileged user.
9. Document every external artifact, expected version, download origin, and integrity value so future audits can evaluate the complete execution chain.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The invocation guidance uses broad trigger phrases like 'save,' 'read,' 'extract,' or 'convert' for any provided X URL without clearly limiting use to long-form X Articles or adding exclusions. In an agentic setting, this can cause over-invocation on ordinary posts or unintended external browsing activity, increasing the chance of unnecessary network access and processing of untrusted URLs.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill description emphasizes zero-config extraction but does not prominently warn that execution requires outbound network access to X and Playwright/Chromium download infrastructure. In restricted or sensitive environments, this can lead to unexpected external connections, policy violations, or failed runs that an agent may initiate without adequate user awareness.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.