Url Shortener

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 8:26 AM UTC
• Version: 1.0.0

Overview

This is a local URL alias helper with minor privacy and clarity caveats, but no evidence of hidden, deceptive, or harmful behavior.

Before installing, treat this as a local alias manager, not a public hosted short-link service. Avoid saving URLs that contain passwords, bearer tokens, private document links, or sensitive query parameters, and use a virtual environment if you install optional QR dependencies.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: scripts/shorten.py:101

Finding

Unpinned Third-Party Dependency Installation Guidance

Content

View full analysis

Vulnerability Details

File Location: scripts/shorten.py, lines 101-103
Vulnerability Type: Unpinned package installation from the default Python package registry
Risk Level: Medium

python

    except ImportError:
        print("Error: qrcode not installed. Run: pip install qrcode[pil]")
        return 1

Technical Analysis

When the optional qrcode module is unavailable, the program instructs the user to install qrcode[pil] without specifying a reviewed version, dependency lockfile, package hashes, or trusted package index.

Although the program does not automatically execute the installation command, following its explicit guidance causes pip to resolve the latest available package and transitive dependencies from the configured registry. Python packages can execute installation or build-related code, and subsequently execute code when imported. Consequently, the effective dependency implementation can change after this skill has been audited.

Attack Path

1. A user invokes QR-code generation with --qr or --qr-file.
2. The qrcode module is not installed, causing the ImportError handler to display the installation command.
3. The user runs pip install qrcode[pil] as instructed.
4. Pip resolves an unpinned release and its transitive dependencies from the configured registry.
5. If a resolved release, dependency, package index, or package distribution has been compromised, attacker-controlled code can execute during package installation or when qrcode is later imported.
6. That code executes with the privileges of the user or environment in which pip and the script are run.

Impact Assessment

Successful exploitation could execute arbitrary code with the privileges of the user performing the installation. Depending on that user's permissions and whether installation occurs inside an isolated environment, the attacker could access user-readable files, modify user-owned reso ...[truncated 305 chars]

Remediation

View remediation

Remediation Suggestions

• Supply a reviewed dependency manifest that pins qrcode and all transitive dependencies to exact versions.
• Include cryptographic hashes and install dependencies with a command such as pip install --require-hashes -r requirements.txt.
• Direct users to create an isolated virtual environment rather than installing packages globally or with elevated privileges.
• Document the expected trusted package index and prohibit unreviewed extra indexes.
• Integrate dependency vulnerability and integrity checks into the release process.
• Replace the unconstrained installation message with instructions referencing the project's reviewed dependency manifest.

T09 · Insecure Skill Coding Practices

Note

• Location: scripts/shorten.py:15

Finding

Potentially Sensitive URLs Stored Without Explicit Restrictive File Protections

Content

View full analysis

Vulnerability Details

File Location: scripts/shorten.py, lines 15-27
Vulnerability Type: Plaintext sensitive-data storage with umask-dependent permissions and unsafe file replacement behavior
Risk Level: Low

python

DATA_FILE = Path.home() / '.url_shortener.json'


def load_data():
    """Load saved URLs from file."""
    if DATA_FILE.exists():
        with open(DATA_FILE) as f:
            return json.load(f)
    return {'urls': {}, 'counter': 0}


def save_data(data):
    """Save URLs to file."""
    with open(DATA_FILE, 'w') as f:
        json.dump(data, f, indent=2)

Technical Analysis

The application persists complete URLs in plaintext at ~/.url_shortener.json. URLs may contain confidential query parameters, bearer-like tokens, internal hostnames, document identifiers, or private path information.

The file is opened with the standard open(..., 'w') operation without explicitly enforcing a restrictive mode such as 0600. A newly created file therefore receives permissions derived from the process umask. If the umask is permissive, other local users may be able to read the stored URL history. If the file already exists with overly broad permissions, rewriting it does not correct those permissions.

The write is also non-atomic and follows symbolic links. If an attacker can create or replace entries in the victim's home directory, a pre-positioned ~/.url_shortener.json symbolic link could redirect the write to another user-writable target. Such an attack requires prior local filesystem access and does not independently bypass operating-system permissions.

Attack Path

Confidentiality path:

1. The application runs under a permissive umask or uses a pre-existing data file with broad permissions.
2. A user shortens a URL containing confidential path or query data.
3. save_data() writes the complete URL to ~/.url_shortener.json in plaintext.
4. Another local acco ...[truncated 1236 chars]

Remediation

View remediation

Remediation Suggestions

• Create the data file with an explicit 0600 mode using a safe low-level open operation with O_CREAT, O_WRONLY, and appropriate anti-symlink protections where supported.
• Verify that an existing path is a regular file owned by the current user and reject symbolic links before reading or writing.
• Correct overly broad permissions on existing data files before use.
• Write to a securely created temporary file in the same directory, flush and synchronize it, and atomically replace the destination.
• Consider storing only the minimum required URL information or encrypting sensitive persisted data using an operating-system-backed credential facility.
• Warn users that URLs containing access tokens, credentials, or confidential query parameters will be persisted locally and displayed by listing and statistics operations.

SkillSpector

Vulnerability Patterns

• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (3)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The skill description overstates what the implementation does and omits important persistence behavior, creating a trust and transparency failure. Users may believe they are getting real short-link hosting and click tracking, while the skill only stores local aliases/statistics-like data, which can mislead operators and cause unintended local data retention.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 89% confidence

Finding

The skill advertises and demonstrates functionality that writes data locally, but it declares no tool scope or permissions to make that behavior explicit. Hidden or undeclared file-write capability weakens user and platform trust boundaries because an agent may persist data without clear authorization or review.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The code stores a field named 'created' for each shortened URL, but it is populated from Path(file).stat().st_ctime, which is the script file's metadata timestamp rather than the time the short URL was created. This contradicts the apparent intent conveyed by the field name and later stats output, which presents it as URL creation data.

Content

No source excerpt is available for this finding.