T09 · Insecure Skill Coding Practices
Error
- Location
scripts/fetch_and_summarize.py:76- Finding
Incomplete SSRF Filtering Permits Access to Local and Special-Purpose Network Addresses
- Content
View full analysis
- Remediation
View remediation
Security audit
Site Summarizer
Security checks for vulnerabilities and agentic risk
Overview
This URL summarizer is purpose-aligned, but its fetcher can reach unintended internal network addresses and stores fetched results locally with limited privacy safeguards.
Review before installing. Use this only in a constrained environment with egress controls or an allowlist for public domains, avoid sensitive or signed URLs, and consider disabling or tightly restricting the cache directory. Do not run it on hosts that can reach internal admin services or cloud metadata endpoints unless the SSRF protections are fixed.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/fetch_and_summarize.py:136- Finding
Incomplete Secret Redaction and Plaintext Caching Can Persist Sensitive Response Data
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (6)
Cloud Metadata Access
High
- Category
- Server-Side Request Forgery
- Confidence
- 90% confidence
- Finding
Code accesses a cloud instance metadata endpoint (e.g. 169.254.169.254). A single request can return temporary IAM credentials, making this a high-value SSRF target for credential theft.
- Content
python # Config BLOCKED = {"file", "ftp", "data", "javascript"} PRIVATE = [ipaddress.ip_network(n) for n in ["10.0.0.0/8", "172.16.0.0/12", "192.168.0.0/16"]] CLOUD = {"169.254.169.254", "100.100.100.200"} # Proper regex patterns SECRETS = [
Cloud Metadata Access
High
- Category
- Server-Side Request Forgery
- Confidence
- 85% confidence
- Finding
Code accesses a cloud instance metadata endpoint (e.g. 169.254.169.254). A single request can return temporary IAM credentials, making this a high-value SSRF target for credential theft.
- Content
python # Config BLOCKED = {"file", "ftp", "data", "javascript"} PRIVATE = [ipaddress.ip_network(n) for n in ["10.0.0.0/8", "172.16.0.0/12", "192.168.0.0/16"]] CLOUD = {"169.254.169.254", "100.100.100.200"} # Proper regex patterns SECRETS = [
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 90% confidence
- Finding
The skill advertises network access, file writing, and environment-variable use through its described functionality, but it does not declare any explicit tool scope or permissions boundary. This creates a transparency and governance gap: operators may enable the skill without understanding that it can fetch arbitrary URLs, write cache files, and consume sensitive environment configuration.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The skill description does not clearly warn users that fetching external URLs may disclose the host's IP/network identity to remote servers, and that IP hiding is only optional. In a URL-fetching skill, this omission is materially risky because users may unknowingly use it on sensitive infrastructure, causing privacy leakage or unintended outbound contact to attacker-controlled endpoints.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
This code fetches remote content from user-supplied URLs and writes the fetched analysis results to a local cache directory, but it provides no confirmation prompt, user-facing log, or warning about those operations. Because the skill transmits user-provided URLs over the network and persists results under ~/.cache/site-summarizer, users are not clearly informed that external requests and local storage will occur.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill returns the resolved server IP address in its output, which is unnecessary for URL summarization and can disclose infrastructure details about visited targets. While not a direct code-execution flaw, it leaks network metadata that may aid reconnaissance or reveal internal addressing if SSRF protections are bypassed or incomplete.
- Content
Static analysis
No suspicious patterns detected.