Security audit

Cn Readability Extractor

Security checks for vulnerabilities and agentic risk

Overview

The skill mostly does what it advertises, but its URL fetcher is too broad and can read local files or internal services reachable from the machine running it.

Install only if you trust users and agents to provide safe public HTTP(S) URLs. Do not use it on internal, authenticated, localhost, metadata-service, or file:// URLs unless that access is explicitly intended and controlled; a safer version should restrict schemes to HTTP(S), block private and local destinations, validate redirects, and cap response size while streaming.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Error

Location: scripts/readability.py:76
Finding: Unrestricted URL Fetching Enables SSRF and Local Resource Disclosure
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 95% confidence
Finding: The skill documents network-capable behavior by accepting a URL and fetching webpage content, but it does not declare any tool scope such as permissions or allowed-tools. This creates an authorization and review gap: operators and users cannot clearly constrain or approve outbound network access, which increases the risk of unintended requests, access to sensitive internal URLs, or policy bypass when the skill is executed in a broader agent environment.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 82% confidence
Finding: The skill name, title, and all instructions are presented only in Chinese, while stating support for both Chinese and English content. This can be a natural-language policy issue if the skill effectively requires a specific language for user interaction without opt-in or an explicit justification for the locale restriction.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The usage instructions tell the user to pass an arbitrary URL, but the documentation omits any warning that the skill will fetch remote content over the network. That omission can lead users to invoke the skill on untrusted or sensitive URLs without understanding the privacy, logging, or SSRF-style implications of making outbound requests.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.