facequet

• Outcome: Review
• Latest audit: Sep 12, 2026 · 4:16 AM UTC
• Version: 1.0.0

Overview

This is a simple URL-reading skill, but it needs review because it can fetch any user-supplied URL from the skill runtime and return the response content.

Review this skill before installing in any environment with access to private networks, cloud metadata, internal dashboards, or sensitive HTTP services. If used, restrict it to approved public domains, block private and metadata IP ranges including redirects, cap response size, and pin dependencies.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/skill.py:53

Finding

Unrestricted Server-Side URL Fetching Enables SSRF

Content

View full analysis

Vulnerability Details

File Location: scripts/skill.py, lines 53-59
Vulnerability Type: Server-Side Request Forgery (SSRF)
Risk Level: High

Vulnerable Code

python

parsed = urlparse(url)
if not parsed.scheme:
    url = "https://" + url

r = requests.get(url, headers=DEFAULT_HEADERS, timeout=12)

Technical Analysis

The URL is entirely user-controlled and is passed to requests.get() without validating its scheme, hostname, port, or resolved IP address. The code does not reject loopback, private, link-local, reserved, or cloud metadata destinations.

In addition, requests.get() follows HTTP redirects by default. Consequently, checking only the initial URL would not be sufficient: a public endpoint could redirect the request to an internal service. The existing urlparse() call only determines whether a scheme is present and does not provide a security boundary.

Attack Path

1. An attacker supplies a URL targeting an internal destination, such as a loopback service, private network host, or cloud metadata endpoint. Alternatively, the attacker supplies a public URL that redirects to such a destination.
2. The Skill executes the request from its own runtime environment.
3. The request reaches a service accessible from the Skill's network context but potentially inaccessible to the attacker directly.
4. The returned document is parsed by BeautifulSoup.
5. Text from an article, paragraph, or metadata field is returned in the JSON response, potentially disclosing internal information.

Impact Assessment

Successful exploitation may allow an attacker to probe services reachable from the Skill's network context, access unauthenticated internal HTTP endpoints, retrieve cloud instance metadata, or disclose portions of internal responses. The effective scope is limited by the network access and identity available to the process, but it may exceed the attacker's direct network privileges.

Remediation

View remediation

Remediation Suggestions

• Accept only explicitly supported schemes, normally https and, if necessary, http.
• Reject URLs containing credentials, ambiguous host syntax, unsupported ports, or malformed hostnames.
• Resolve the hostname before connecting and reject every address in loopback, private, link-local, multicast, unspecified, reserved, and other non-public ranges for both IPv4 and IPv6.
• Explicitly block cloud metadata destinations, including link-local metadata addresses.
• Prefer an allowlist of legitimate domains when the intended use is limited to Facebook or another known service.
• Disable automatic redirects or validate the scheme, hostname, port, and resolved IP address of every redirect target before following it.
• Account for DNS rebinding by ensuring that the validated address is the address actually used for the connection.
• Apply outbound firewall or proxy restrictions as defense in depth.

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/skill.py:59

Finding

Unbounded HTTP Response Download and HTML Parsing

Content

View full analysis

Vulnerability Details

File Location: scripts/skill.py, lines 59-63
Vulnerability Type: Resource Exhaustion Through Unbounded Remote Content
Risk Level: Medium

Vulnerable Code

python

r = requests.get(url, headers=DEFAULT_HEADERS, timeout=12)
if r.status_code >= 400:
    return {"status":"error", "content": f"HTTP {r.status_code} returned for {url}"}

soup = BeautifulSoup(r.text, "html.parser")

Technical Analysis

The implementation downloads and decodes the complete response through r.text, then parses the entire document with BeautifulSoup. It does not enforce a maximum response-body size or validate Content-Length.

The configured timeout does not impose a maximum number of bytes and is not a reliable total execution deadline. A malicious or compromised server can therefore return a very large document or HTML structured to consume substantial parser resources.

Attack Path

1. An attacker provides a URL under their control.
2. The remote server returns an extremely large or computationally expensive HTML response.
3. The requests library buffers the response, and accessing r.text creates a decoded in-memory representation.
4. BeautifulSoup builds a parse tree for the full document.
5. The Skill consumes excessive memory or CPU, delaying processing or terminating the process.

Impact Assessment

Exploitation can cause denial of service against the Skill process and may affect other workloads sharing the same worker or resource limits. This issue does not directly grant additional system privileges, but it allows an untrusted remote endpoint to consume application memory, CPU time, and execution capacity.

Remediation

View remediation

Remediation Suggestions

• Use stream=True and read the response incrementally.
• Enforce a strict maximum response size while reading, regardless of whether Content-Length is present.
• Reject responses whose declared Content-Length exceeds the configured limit.
• Stop reading and close the response immediately when the byte limit is reached.
• Set separate connection and read timeouts and enforce an application-level total deadline.
• Restrict accepted content types to expected HTML or plain-text media types.
• Parse only after the response has passed size and content-type checks.
• Run parsing under appropriate process memory and CPU limits as defense in depth.

T08 · Insecure Dependencies

Note

• Location: requirements.txt:1

Finding

Third-Party Dependencies Are Not Version-Pinned

Content

View full analysis

Vulnerability Details

File Location: requirements.txt, lines 1-2
Vulnerability Type: Non-Reproducible and Mutable Dependency Resolution
Risk Level: Low

Vulnerable Code

text

requests
beautifulsoup4

Technical Analysis

The dependencies are declared without exact versions or integrity hashes. Each installation can therefore resolve to different package releases, including releases that were not reviewed with this Skill. This weakens build reproducibility and makes it harder to control exposure to compromised, incompatible, or newly vulnerable dependency versions.

No evidence was found that the package names themselves are typosquatted or intentionally malicious. The confirmed issue is the absence of dependency version and integrity controls.

Attack Path

1. The Skill is installed or rebuilt at a later date.
2. The package resolver selects the latest versions permitted by the unconstrained requirements.
3. If a selected release is compromised or contains an exploitable regression, its installation or runtime code enters the Skill environment.
4. That dependency code executes with the same operating-system and network privileges as the installer or Skill process.

Impact Assessment

The impact depends on the behavior of the subsequently resolved package release. A compromised dependency could potentially access files, environment variables, network resources, and other capabilities available to the installation or runtime process. In ordinary circumstances, the more immediate consequences are non-reproducible builds, unexpected behavior changes, and delayed vulnerability management.

Remediation

View remediation

Remediation Suggestions

• Pin each dependency to an explicitly reviewed version.
• Generate and commit a lock file appropriate for the deployment workflow.
• Record cryptographic hashes and install with pip --require-hashes.
• Use a trusted, explicitly configured package index.
• Run automated dependency vulnerability and license scanning.
• Establish a controlled process for reviewing and updating pinned versions.
• Build and install dependencies in a least-privileged, isolated environment.

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (6)

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The manifest's user-facing description is written in Vietnamese, which imposes a specific language choice without offering an alternative or indicating that the skill is region-specific. This conflicts with the policy requirement to avoid forcing a language or locale unless the constraint is explicitly documented and justified.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The docstring and user-facing output description are written in Vietnamese, and runtime messages later in the file also use Vietnamese phrasing. There is no indication that the skill is intentionally region-specific or that users can opt into this locale, which creates a language policy concern for a general-purpose skill.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 85% confidence

Finding

The file mixes English schema labels with Vietnamese instructional text such as "mẫu" and "nếu lưu lại," which imposes a specific language choice in natural-language content. There is no indication that Vietnamese is optional or that this schema is intentionally region-specific, so it may violate language/locale policy requirements.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 96% confidence

Finding

The dependency 'requests' is unpinned, so installs may pull different versions over time, including versions with known security flaws or breaking changes. In a security-sensitive agent skill, this weakens supply-chain integrity and makes builds non-reproducible.

Content

Scanner excerpt · requirements.txt (reported line 1)May include surrounding context.

text

requests
beautifulsoup4

Unverifiable Dependency: requests has 16 known advisory(ies) (CVE-2014-1830 (Exposure of Sensitive Information to an Unauthorized Actor in Requests); CVE-2024-47081 (Requests vulnerable to .netrc credentials leak via malicious URLs); CVE-2024-35195 (Requests `Session` object does not verify requests after making first request wi) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 90% confidence

Finding

The manifest includes 'requests' without a version pin, and the package has multiple published advisories across releases. Because no version is specified, it is impossible to determine whether deployments will install a vulnerable release, which raises real supply-chain and runtime security risk.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 94% confidence

Finding

The dependency 'beautifulsoup4' is unpinned, which allows environment-dependent resolution to arbitrary newer or older releases. This creates reproducibility and supply-chain risk because security posture cannot be verified from the manifest alone.

Content

Scanner excerpt · requirements.txt (reported line 2)May include surrounding context.

text

requests
beautifulsoup4

Static analysis

No suspicious patterns detected.