T09 · Insecure Skill Coding Practices
Error
- Location
scripts/scrape.py:22- Finding
TLS Certificate and Hostname Verification Disabled
- Content
View full analysis
- Remediation
View remediation
Security audit
Data Scraper
Security checks for vulnerabilities and agentic risk
Overview
This web-scraping skill has a coherent purpose, but it silently weakens HTTPS security and can fetch arbitrary internal or local URLs from the agent's environment.
Review this skill before installing. Use it only in a constrained environment, avoid authenticated or sensitive targets, do not scrape private/internal URLs, and treat saved output as potentially sensitive. The TLS verification bypass should be removed or made an explicit insecure opt-in before routine use.
Vulnerability Patterns
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)
T05 · Unauthorized Access and Privilege Escalation
Error
- Location
scripts/scrape.py:27- Finding
Unrestricted User-Controlled URL Fetching Enables SSRF and Local Resource Access
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (6)
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 94% confidence
- Finding
The skill advertises network access and local file output behavior but does not declare any explicit tool scope such as allowed-tools or permissions. That creates an authorization gap where an agent may invoke network and file-write capabilities without clear least-privilege boundaries, increasing the chance of unintended scraping, data exfiltration, or unsafe local writes.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The description is broad enough to match many generic research, shopping, news, and dataset-building requests, which can cause over-triggering of a skill with network and file-write capabilities. In an agent environment, overly broad activation increases the risk that scraping actions occur in contexts where the user did not specifically intend external collection or data persistence.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The documentation explicitly supports authenticated scraping and writing results to local files, but it does not warn about credential storage, session handling, sensitive content capture, or the risks of persisting scraped data. This is especially concerning in a scraping skill because authentication plus file output can expose secrets, collect private data, or leave sensitive artifacts on disk.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The scraper explicitly disables TLS certificate validation and hostname verification before fetching remote content. This allows a man-in-the-middle attacker to intercept or modify HTTPS responses, defeating transport security and causing the scraper to consume tampered data from sites and APIs.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
Network requests to potentially sensitive HTTPS endpoints are made with certificate verification disabled and no meaningful warning to the user. An attacker on the network path could spoof the target server, inject false content, or harvest requested data while the user believes the connection is protected.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 85% confidence
- Finding
The script writes extracted content to a user-specified path in multiple formats, which is a file-write operation covered by the warning requirement. While it prints 'Saved to' after writing, there is no prior confirmation, warning, or documentation that data will be persisted to disk and may overwrite an existing file.
- Content
Static analysis
No suspicious patterns detected.