Web Monitor

• Outcome: Review
• Latest audit: Jun 18, 2026 · 11:30 PM UTC
• Version: 1.0.0

Overview

This web monitor mostly matches its stated purpose, but it gives change notifications arbitrary local command execution and silently disables HTTPS certificate checks.

Install only if you are comfortable reviewing and controlling every --notify command yourself. Do not pass untrusted text into --notify, avoid running it with elevated privileges, and be aware that HTTPS monitoring results can be spoofed because certificate verification is disabled in the code.

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (8)

os.system() or os exec-family call

High

• Category: Dangerous Code Execution

Content

print(f"Previous: {prev['hash'][:16]}...")
                print(f"Current:  {current_hash[:16]}...")
                if args.notify:
                    os.system(args.notify)
                return 2
        else:
            print(f"No previous data to compare (file: {args.compare})")

• Confidence: 98% confidence
• Finding: The script passes the user-controlled --notify value directly to os.system(), which invokes a shell. This allows arbitrary command execution if an attacker can influence CLI arguments or configuration, and it is broader than a simple notification mechanism expected from a web-monitoring skill.

os.system() or os exec-family call

High

• Category: Dangerous Code Execution

Content

if new_hash != current_hash:
                        print(f"\n[{datetime.now().isoformat()}] CHANGE DETECTED!")
                        if args.notify:
                            os.system(args.notify)
                        current_hash = new_hash
                        data['hash'] = new_hash
                        data['content'] = new_content if not args.hash_only else None

• Confidence: 98% confidence
• Finding: In watch mode, the same user-controlled notification command is executed via os.system() whenever a change is detected. This repeatedly exposes arbitrary shell execution and can turn a content change event into a command-trigger mechanism.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence
• Finding: The skill advertises capabilities that include network access, file writes, and shell command execution, but it declares no permissions or safety boundaries. This is dangerous because users and orchestrators cannot accurately assess or restrict what the skill can do, especially when the documented interface includes a notification hook that can execute commands.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: The documented behavior materially understates risky functionality: arbitrary local command execution via --notify and insecure HTTPS handling if certificate verification is disabled. That mismatch is dangerous because users may invoke the skill expecting simple page monitoring while unknowingly enabling code execution and accepting spoofed network content, which can lead to host compromise or false monitoring results.

Context-Inappropriate Capability

High

• Confidence: 95% confidence
• Finding: The notification feature is implemented as unrestricted shell command execution rather than a bounded notification action. In the context of a web-page monitor, this materially expands capability from monitoring into arbitrary code execution, increasing risk if the tool is embedded, scripted, or used with untrusted input.

Context-Inappropriate Capability

Medium

• Confidence: 93% confidence
• Finding: TLS certificate and hostname verification are explicitly disabled before fetching monitored pages. This allows man-in-the-middle attacks to spoof page content, causing false change detection, concealment of real changes, or delivery of attacker-controlled content into saved output.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The examples and description expose a --notify command hook without warning that it executes arbitrary shell commands on change detection. In the context of an automation skill, this increases the chance that users will pass untrusted or templated input into a shell context, creating command-injection and unintended code-execution risk.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The CLI help says --notify is a 'Command to run on change' but does not adequately communicate the security implications of arbitrary shell execution. In a skill advertised for monitoring and notification integration, this can surprise users and lead to unsafe deployment assumptions.

Static analysis

Detected: suspicious.insecure_tls_verification

HTTPS certificate verification is disabled.

Warn

• Code: suspicious.insecure_tls_verification
• Location: scripts/monitor.py:29