Web Monitor

• Outcome: Review
• Latest audit: May 29, 2026 · 9:39 PM UTC
• Version: 1.0.0

Overview

This web-monitoring skill is mostly purpose-aligned, but it disables HTTPS verification and can run user-supplied shell commands when a webpage changes.

Review before installing. Avoid using this for sensitive or security-critical monitoring unless TLS verification is fixed, and do not use --notify with commands that modify files, expose secrets, or perform account actions. Prefer --hash-only for private pages so full page content is not saved locally.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (8)

os.system() or os exec-family call

High

• Category: Dangerous Code Execution

Content

print(f"Previous: {prev['hash'][:16]}...")
                print(f"Current:  {current_hash[:16]}...")
                if args.notify:
                    os.system(args.notify)
                return 2
        else:
            print(f"No previous data to compare (file: {args.compare})")

• Confidence: 98% confidence
• Finding: os.system(args.notify)

os.system() or os exec-family call

High

• Category: Dangerous Code Execution

Content

if new_hash != current_hash:
                        print(f"\n[{datetime.now().isoformat()}] CHANGE DETECTED!")
                        if args.notify:
                            os.system(args.notify)
                        current_hash = new_hash
                        data['hash'] = new_hash
                        data['content'] = new_content if not args.hash_only else None

• Confidence: 98% confidence
• Finding: os.system(args.notify)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 89% confidence
• Finding: The skill advertises capabilities that imply network access, file writes, and shell execution, but it declares no permissions or safety boundaries. That mismatch is dangerous because users and orchestrators cannot make an informed trust decision, especially when the skill can fetch remote content, persist state, and invoke a notification command.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: This is a true vulnerability because the documented behavior omits or downplays materially risky implementation details: arbitrary shell command execution via --notify and disabled SSL certificate verification. Those behaviors can enable command injection, unsafe local execution, and man-in-the-middle exposure while giving users a misleading sense of safety about what the skill actually does.

Context-Inappropriate Capability

High

• Confidence: 97% confidence
• Finding: Executing arbitrary shell commands is not necessary for the stated purpose of monitoring web pages for changes. Because the command is triggered by detection logic and can be fully user-defined, the tool can be repurposed as an event-driven execution primitive, which is dangerous in agentic or automated environments.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: The watch loop makes arbitrary command execution especially risky because external website content controls when notifications fire. An attacker who can influence the monitored page, or a compromised site, can cause repeated command execution and abuse the monitor as a remote trigger.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: Omitting a clear warning that change notifications execute arbitrary shell commands is security-relevant because users may pass untrusted input or enable the feature without understanding it causes local command execution. In the context of a web-monitoring skill, this is more dangerous because remote web content can influence when notifications fire, turning a monitoring event into a trigger for unexpected command execution.

Missing User Warnings

Medium

• Confidence: 84% confidence
• Finding: The tool exposes shell execution through a minimally described --notify option without a strong warning about arbitrary command execution. In practice this increases the chance of unsafe use, especially when embedded in larger automation where operators may not realize they are enabling shell execution.

VirusTotal

64/64 vendors flagged this skill as clean.

Static analysis

Detected: suspicious.insecure_tls_verification

HTTPS certificate verification is disabled.

Warn

• Code: suspicious.insecure_tls_verification
• Location: scripts/monitor.py:29