Url Shortener

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 9:40 AM UTC
• Version: 1.0.0

Overview

This is a small local URL-alias tool with some overstated features and privacy caveats, but no evidence of hidden, destructive, or exfiltrating behavior.

Install only if you are comfortable with a local-only URL alias tool. Do not store password-reset links, signed URLs, API tokens, or other secret-bearing URLs in it, and treat the QR dependency install suggestion as manual guidance that should be pinned or reviewed in sensitive environments.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Note

• Location: scripts/shorten.py:96

Finding

Unpinned Third-Party Package Installation Guidance

Content

View full analysis

Vulnerability Details

File Location: scripts/shorten.py, lines 96-98
Vulnerability Type: Insecure third-party dependency installation guidance
Risk Level: Low

Complete Code Snippet

python

    except ImportError:
        print("Error: qrcode not installed. Run: pip install qrcode[pil]")
        return 1

Technical Analysis

When the optional QR-code dependency is unavailable, the script instructs the user to install qrcode[pil] without specifying a reviewed version, package hash, lockfile, or trusted package index. The script does not automatically execute this command, so exploitation requires the user or an automation layer to follow the displayed guidance.

Because the dependency is mutable and retrieved through the environment's configured Python package index, the installed implementation and its transitive dependencies can differ from those reviewed by the project. A compromised package release, compromised package index, or maliciously configured index could consequently introduce attacker-controlled code during package building, installation, or subsequent import.

Attack Path

1. A user requests QR-code generation in an environment where qrcode is not installed.
2. The import fails and the script displays pip install qrcode[pil].
3. The user executes the suggested command.
4. pip resolves an unpinned package and its dependencies through the configured package index.
5. If the selected package, dependency, release, or index is compromised, attacker-controlled code may run during installation or when the package is imported on a later invocation.

Impact Assessment

Successful exploitation could execute code with the privileges of the user running pip or the URL-shortener script. This may permit access to that user's files, environment variables, credentials, and network capabilities. The scope does not inherently include elevated system privileges unless installati ...[truncated 53 chars]

Remediation

View remediation

Remediation Suggestions

• Declare the optional QR dependency in a reviewed dependency manifest rather than relying only on runtime installation instructions.
• Pin reviewed direct and transitive dependency versions.
• Provide a lockfile or hash-verified requirements file and recommend installation with hash verification, such as pip install --require-hashes.
• Document the trusted package index or repository from which dependencies must be obtained.
• Integrate dependency vulnerability and provenance checks into release workflows.
• Avoid recommending elevated installation commands.

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/shorten.py:14

Finding

Potentially Sensitive URLs Stored in a Plaintext File with Implicit Permissions

Content

View full analysis

Vulnerability Details

File Location: scripts/shorten.py, lines 14 and 23-26
Vulnerability Type: Plaintext storage of potentially sensitive data with no explicit access controls
Risk Level: Medium

Complete Code Snippet

python

DATA_FILE = Path.home() / '.url_shortener.json'


def save_data(data):
    """Save URLs to file."""
    with open(DATA_FILE, 'w') as f:
        json.dump(data, f, indent=2)

The sensitive value placed into this file is stored by the following code at lines 50-54:

python

    data['urls'][short_code] = {
        'url': url,
        'clicks': 0,
        'created': str(Path(__file__).stat().st_ctime)
    }

Technical Analysis

The application stores complete submitted URLs in ~/.url_shortener.json as plaintext. URLs can contain confidential paths, personal information, API credentials, session identifiers, signed query parameters, password-reset tokens, or other bearer secrets.

The file is opened with the process's default creation behavior, and no restrictive mode such as 0600 is explicitly enforced. Its effective permissions therefore depend on the user's umask. Under a permissive umask, other local accounts may be able to read the stored URL history. If the file already exists with overly broad permissions, opening it for writing does not correct those permissions.

The file is also rewritten directly rather than through a securely created temporary file followed by an atomic replacement. This may expose partially written data after interruption, although the primary confidentiality issue is plaintext persistence without explicit access control.

Attack Path

1. A user shortens a URL containing a sensitive path, query parameter, signed token, or other confidential value.
2. shorten_url() stores the complete URL in the in-memory data structure.
3. save_data() serializes the URL in plaintext to ~/.url_shortener.json.
4. The file is c ...[truncated 791 chars]

Remediation

View remediation

Remediation Suggestions

• Create the data file with owner-only permissions (0600) and explicitly verify or repair permissions whenever an existing file is opened.
• Create the parent directory with owner-only permissions (0700) if storage is moved into a dedicated application directory.
• Use a securely created temporary file with restrictive permissions, flush it as appropriate, and atomically replace the destination to avoid partial writes.
• Warn users that complete URLs are persisted locally.
• Reject, redact, or separately protect sensitive query parameters and fragments before persistence.
• Consider encryption at rest using an operating-system credential store when confidential URLs must be retained.
• Provide a command to delete individual entries and securely clear the complete local history.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (3)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The code broadly aligns with shortening URLs, custom aliases, listing saved entries, and QR generation. However, the declared description says it can track click statistics, while the implementation only stores a clicks field initialized to 0 and never updates it. As a result, the reported statistics are not real tracking data. Additionally, it does not create functional short URLs in the sense of a resolvable redirecting service; it only stores local alias-to-URL mappings and prints the alias. This is a material behavior gap from the declared purpose.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 70% confidence

Finding

Without declared permissions the skill's intent is opaque and cannot be validated.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The manifest description says to use the skill whenever a user needs to shorten URLs, create links, track statistics, or generate QR codes, but it does not define specific trigger phrases, boundaries, or exclusion conditions. This broad natural-language activation guidance could overlap with common requests about links or QR codes and lead to unintended invocation.

Content

No source excerpt is available for this finding.