T09 · Insecure Skill Coding Practices
Error
- Location
scripts/sitemap_gen.py:72- Finding
TLS Certificate and Hostname Verification Disabled
- Content
View full analysis
- Remediation
View remediation
Security audit
Sitemap Generator
Security checks for vulnerabilities and agentic risk
Overview
This is a coherent sitemap generator, but its crawler silently disables HTTPS verification and can be redirected outside the promised same-domain boundary.
Review before installing. Use it only when you intend to let the agent crawl a specified site or scan a chosen local directory, and avoid using it on sensitive internal sites or untrusted networks until TLS verification and redirect destination validation are fixed. Check output paths because --output and --robots write files in the workspace.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/sitemap_gen.py:79- Finding
Automatic Redirects Bypass the Same-Domain Crawl Restriction
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (5)
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
HTTPS requests are made with authentication of the remote endpoint disabled and no warning to the user. In a security-sensitive crawling context, this means network attackers can tamper with responses, causing the tool to trust and process spoofed HTML as if it came from the intended domain.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 97% confidence
- Finding
The skill instructs the agent to perform network access, read local files, and write output files, but it does not declare any explicit tool scope or permissions boundaries. In an agent environment, this increases the chance of unintended website crawling or filesystem writes occurring without clear user consent or policy enforcement.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The trigger phrases are broad enough to match common requests like "robots.txt" or "sitemap," which may invoke this skill in contexts where the user did not intend live crawling or file generation. Overbroad activation can cause the agent to select a higher-risk skill than necessary, leading to unexpected network requests or filesystem modifications.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The skill documentation does not clearly warn that it may crawl live websites and write files like sitemap.xml and robots.txt. Without explicit disclosure, users or orchestrators may not realize that using the skill can initiate external network activity and modify the local workspace, which raises consent and safety concerns.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The crawler explicitly disables both TLS certificate validation and hostname verification before fetching HTTPS pages. This allows a man-in-the-middle attacker to impersonate any target site, alter crawled content, and inject arbitrary links into the generated sitemap without detection.
- Content