Security audit
Security checks for vulnerabilities and agentic risk
This skill is a straightforward Jina AI web-reading wrapper, with expected third-party API use and no hidden destructive or deceptive behavior found.
Install only if you are comfortable sending submitted URLs, search terms, page targets, and fact-check statements to Jina AI. Do not use it with private intranet URLs, secrets, regulated data, or confidential research topics unless that third-party processing is approved. Prefer an environment variable or a managed secret store for the API key on shared systems.
The skill documents shell-based execution through {baseDir}/scripts/reader.sh but does not declare any explicit tool scope such as permissions or allowed-tools. That mismatch can cause the agent runtime or reviewer to underestimate the skill's execution capabilities, increasing the risk of unintended shell access or overbroad invocation in environments that rely on metadata for policy decisions.
The description says the skill extracts web content via Jina AI, but it does not clearly warn that user-supplied URLs, search queries, and fact-check statements are transmitted to a third-party API. This can lead users to unknowingly send sensitive internal URLs, proprietary research topics, or confidential claims off-platform, creating privacy and data-handling risks.
The skill encourages persistent storage of the API key in ~/.config/jina/api_key, which creates a session-persistence and credential-residue risk on shared, ephemeral, or multi-user systems. While common and not inherently malicious, long-lived local secrets can be recovered later by other processes, backups, or users if the environment is not tightly controlled.
export JINA_API_KEY="jina_..."
mkdir -p ~/.config/jina && echo "jina_..." > ~/.config/jina/api_key chmod 600 ~/.config/jina/api_key
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
mkdir -p ~/.config/jina && echo "jina_..." > ~/.config/jina/api_key chmod 600 ~/.config/jina/api_key
Free tier: 10M tokens (no signup needed). Get key at https://jina.ai/reader/
The manifest describes a web content extraction skill with read/search/ground modes, but it does not mention credential discovery from the runtime environment or local filesystem. The code explicitly reads JINA_API_KEY and falls back to ~/.config/jina/api_key, which is an additional sensitive-data access capability beyond the core extraction behavior.
The script sends arbitrary user-supplied URLs, search queries, or statements to third-party Jina endpoints, and may also attach a bearer token if configured. That creates a real privacy and data-handling risk if users pass sensitive internal URLs, proprietary queries, or confidential statements without clear disclosure that the content leaves the local environment.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
;;
search)
ENCODED_QUERY=$(printf '%s' "$INPUT" | jq -sRr @uri)
RESPONSE=$(curl -sS "${HEADERS[@]}" "https://s.jina.ai/${ENCODED_QUERY}" 2>&1)
;;
ground)
RESPONSE=$(curl -sS "${HEADERS[@]}" \
The options mention geo-proxy use and the feature list mentions headless Chrome rendering through Jina's infrastructure, but the skill does not clearly warn that browsing activity is routed and rendered by a third party. This matters because remote rendering and proxying can expose access patterns, target URLs, and page content to external infrastructure beyond the local environment.
No suspicious patterns detected.