Emily Web Fetch

• Analyzed: May 11, 2026, 5:38 AM
• Findings: 1
• Version: 1.0.5
• Hash: fe1d2de8be2513c6c07068e94e3721d148a02526bf94384d1af622d60ae8d547
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill provides a tool to fetch web content via HTTP/HTTPS, but the implementation in index.js lacks any URL validation or IP blacklisting. This creates a significant Server-Side Request Forgery (SSRF) vulnerability, potentially allowing the agent to access internal network resources or metadata services (e.g., 169.254.169.254). While the behavior aligns with the stated purpose in SKILL.md and there is no evidence of intentional malice, the high-risk nature of unconstrained network requests warrants a suspicious classification.