Agent Skills Search

• Outcome: Pass
• Latest audit: Sep 10, 2026 · 7:07 AM UTC
• Version: 1.0.0

Overview

This skill is a small, disclosed Agnxi search helper that fetches a public sitemap and searches it locally, with minor availability and scoping documentation caveats.

Reasonable to install if you want an agent to search Agnxi for tools, MCP servers, and skills. Be aware that invoking it performs a live request to Agnxi, and the script should ideally add timeout and response-size limits before use in tightly controlled or shared environments.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: search.py:11

Finding

Unbounded Remote Sitemap Retrieval and Parsing Can Cause Resource Exhaustion

Content

View full analysis

Vulnerability Details

File Location: search.py, lines 11-20
Vulnerability Type: Unbounded network response processing and missing request timeout
Risk Level: Medium

python

def fetch_sitemap():
    """Fetches the sitemap from Agnxi.com."""
    try:
        with urllib.request.urlopen(SITEMAP_URL) as response:
            return response.read()
    except Exception as e:
        print(f"Error fetching sitemap: {e}", file=sys.stderr)
        return None

def parse_sitemap(xml_content, query):
    """Parses sitemap XML and filters based on query."""
    try:
        root = ET.fromstring(xml_content)

Technical Analysis

The call to urllib.request.urlopen() does not specify a timeout, so the process can remain blocked while connecting to or reading from an unresponsive upstream server. In addition, response.read() reads the complete HTTP response into memory without enforcing a maximum size.

The resulting attacker-controlled byte sequence is subsequently passed to ET.fromstring(), which constructs an in-memory XML tree. A very large sitemap can therefore consume substantial memory both as raw response data and as parsed XML objects. Although the fixed HTTPS endpoint limits who can directly supply the response, exploitation is possible if the Agnxi server, domain, or content-delivery infrastructure is compromised or begins serving malformed or oversized content.

Attack Path

1. An attacker gains control over, or compromises, the configured Agnxi sitemap endpoint or its serving infrastructure.
2. The attacker serves the sitemap extremely slowly or returns an excessively large XML document.
3. A user or agent invokes search.py, causing fetch_sitemap() to request the malicious response.
4. Without a timeout, the connection can block execution indefinitely. Alternatively, response.read() allocates memory for the entire response.
5. ET.fromstring() performs additional proce ...[truncated 660 chars]

Remediation

View remediation

Remediation Suggestions

• Supply a conservative timeout to urlopen(), for example:

  python

  with urllib.request.urlopen(SITEMAP_URL, timeout=10) as response:
  

• Do not use an unrestricted response.read(). Read the response incrementally in bounded chunks and abort when a defined maximum sitemap size is exceeded.
• Check the Content-Length header when present, while still enforcing the limit during streaming because that header may be absent or inaccurate.
• Validate the response status and expected XML content type before parsing.
• Consider incremental XML parsing to avoid retaining both the complete raw response and the complete parsed tree in memory.
• Apply operating-system or container-level limits for memory, CPU time, and execution duration as defense in depth.
• Return a controlled error when timeout, size, status, content-type, or parsing validation fails.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (2)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The README states that the agent will automatically use the search_agnxi tool when asked to find new tools, and the example prompts are broad enough to match common user requests. This creates unclear activation boundaries: an agent may invoke external search and fetch remote content in situations where the user did not explicitly request tool execution or network access, increasing the risk of unintended data exposure, prompt-surface expansion, or tool overuse.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 89% confidence

Finding

The skill invokes a local Python script that performs live queries against an external sitemap, which implies network-capable behavior, but the manifest does not declare any tool scope such as permissions or allowed-tools. This weakens security boundaries because an agent or reviewer cannot easily determine what external access the skill expects, making unintended or expanded network use harder to detect and control.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.