Traktor Web Scraper

• Outcome: Review
• Latest audit: Sep 10, 2026 · 8:50 PM UTC
• Version: 1.0.0

Overview

This skill does what it advertises, but it gives agents broad web-scraping, background-task, local-write, and shell-download instructions without enough safety controls.

Install only if you are comfortable with an agent browsing supplied sites, spawning background extraction tasks, downloading remote assets, and writing files into your project. Prefer using it in a restricted workspace and network environment, and avoid running it on untrusted or attacker-controlled sites until URL validation, filename sanitization, allowlists, and explicit confirmation controls are added.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:217
• Finding: Command Injection Through Untrusted Shell Command Interpolation<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 217–233 **Vulnerability Type**: OS command injection **Risk Level**: High ### Vulnerable Code ```bash For each asset URL discovered, download using curl with error handling. If curl fails (non-zero exit), log the URL and continue to the next asset. # Logos (favicon, og:image, header logos) curl -sfLo "{output_dir}/logos/{site-name}-favicon.ico" "{favicon_url}" || echo "FAIL: {favicon_url}" curl -sfLo "{output_dir}/logos/{site-name}-og-image.png" "{og_image_url}" || echo "FAIL: {og_image_url}" # Images curl -sfLo "{output_dir}/images/{site-name}-{descriptive-name}.{ext}" "{image_url}" || echo "FAIL: {image_url}" # SVGs - Write inline SVGs to files using Write tool # Videos curl -sfLo "{output_dir}/videos/{site-name}-{name}.mp4" "{video_url}" || echo "FAIL: {video_url}" # Fonts curl -sfLo "{output_dir}/fonts/{font-name}.woff2" "{font_url}" || echo "FAIL: {font_url}" ``` ### Technical Analysis The skill instructs an agent to construct Bash commands by interpolating values derived from a user-supplied URL and an untrusted website. These values include asset URLs, site names, descriptive names, extensions, and output paths. Wrapping a substitution in double quotes is not sufficient if the generated value itself is inserted as shell source text. A value containing a double quote can terminate the quoted argument, after which shell operators, command substitutions, redirections, or additional commands may be interpreted. The failure-reporting expressions also interpolate the same untrusted URLs into `echo` commands. Filename generation is particularly exposed because the instructions recommend deriving descriptive names from asset alt text or surrounding context. Both are fully controlled by the target website. No validation, canonicalization, escaping function, fixed filename generation, or argument-array execution mechanism is required. ### Attack Path 1. An attacker operates a websi ...[truncated 1519 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Do not create shell source strings containing website-derived values. 2. Use a downloader API or execute `curl` through an argument-array interface where each URL and destination is passed as a distinct argument without shell evaluation. 3. Generate output filenames locally from random identifiers or cryptographic hashes rather than alt text or URL components. 4. If human-readable names are required, apply a strict allowlist such as ASCII letters, digits, hyphens, and underscores, then impose a maximum length. 5. Validate extensions against a fixed allowlist and determine file types from verified response metadata or file signatures. 6. Canonicalize each destination path and verify that it remains inside the intended output directory before writing. 7. Reject control characters, quotes, shell metacharacters, path separators, and traversal sequences in every value used for naming. 8. Avoid interpolating failed URLs into shell-based logging. Use structured logging or safely pass the URL as data. 9. Run downloads in a sandbox with minimal filesystem access, no unnecessary credentials, and restricted outbound networking. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:93
• Finding: Unrestricted URL Navigation and Asset Retrieval Enables SSRF<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, line 93 and lines 217–233 **Vulnerability Type**: Server-side request forgery and unsafe resource retrieval **Risk Level**: High ### Vulnerable Code ```text 3. Call mcp__claude-in-chrome__navigate with url="{URL}" and the new tabId ``` ```bash For each asset URL discovered, download using curl with error handling. If curl fails (non-zero exit), log the URL and continue to the next asset. # Logos (favicon, og:image, header logos) curl -sfLo "{output_dir}/logos/{site-name}-favicon.ico" "{favicon_url}" || echo "FAIL: {favicon_url}" curl -sfLo "{output_dir}/logos/{site-name}-og-image.png" "{og_image_url}" || echo "FAIL: {og_image_url}" # Images curl -sfLo "{output_dir}/images/{site-name}-{descriptive-name}.{ext}" "{image_url}" || echo "FAIL: {image_url}" # SVGs - Write inline SVGs to files using Write tool # Videos curl -sfLo "{output_dir}/videos/{site-name}-{name}.mp4" "{video_url}" || echo "FAIL: {video_url}" # Fonts curl -sfLo "{output_dir}/fonts/{font-name}.woff2" "{font_url}" || echo "FAIL: {font_url}" ``` ### Technical Analysis The skill accepts arbitrary user-provided navigation URLs and subsequently retrieves every discovered asset URL with `curl`. It does not impose restrictions on: - URL schemes. - Destination hostnames or ports. - Loopback, link-local, private, multicast, or reserved addresses. - DNS resolution results. - Cross-origin asset URLs. - Redirect destinations. - Requests to services reachable only from the agent's network. A malicious page can provide asset references to internal HTTP services or other resources available from the agent host. Because the downloader runs in the agent's environment rather than in the user's external browser context, it may have access to internal services unavailable to an external attacker. Downloaded responses are persisted in the project, which can expose their contents to later processing or reporting. The limit of 100 assets per c ...[truncated 1720 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Restrict both initial and discovered URLs to explicitly approved `https://` origins; allow `http://` only when the user explicitly authorizes it. 2. Reject URLs containing embedded credentials, unsupported schemes, malformed hosts, or unexpected ports. 3. Resolve hostnames before each request and reject loopback, link-local, private, multicast, unspecified, and reserved IP ranges for both IPv4 and IPv6. 4. Repeat destination validation after every DNS resolution and redirect to prevent DNS rebinding and redirect-based bypasses. 5. Disable redirects by default. If redirects are necessary, enforce a low redirect limit and validate every destination. 6. Prefer same-origin asset downloads. Require explicit confirmation before retrieving cross-origin resources. 7. Route retrieval through a network sandbox or proxy that blocks access to internal address ranges and metadata endpoints. 8. Apply connection, transfer, and total-operation timeouts as well as response-size limits before writing data. 9. Verify response content types and file signatures before persisting downloaded files. 10. Record blocked requests in the manifest without fetching them so users can review them safely. ]]>

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (3)

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The skill directs broad scraping, parallel extraction, and local persistence of large amounts of remote content without an upfront warning about resource usage, storage impact, legal/compliance considerations, or the fact that it will create files and perform many network requests. In context, this can lead users to trigger high-impact actions unintentionally and increases the chance of unsafe or unauthorized data collection.

Context-Inappropriate Capability

Medium

• Confidence: 93% confidence
• Finding: The skill instructs execution of shell commands that incorporate values derived from user-supplied URLs and dynamically discovered asset URLs, including mkdir and curl. Without strict validation, normalization, and safe argument construction, this creates command-injection and unsafe filesystem-write risks, especially when prompts or implementations interpolate hostile values into shell commands.

Description-Behavior Mismatch

Low

• Confidence: 76% confidence
• Finding: The manifest description presents the skill primarily as a website asset/content extractor. The implementation goes beyond pure extraction by performing extensive local filesystem modification: creating directory trees, writing JSON manifests, and downloading copies of remote assets to disk. While related to scraping, this behavior is broader than a simple extraction/read-only interpretation of the description.

Static analysis

No suspicious patterns detected.