T08 · Insecure Dependencies
Warning
- Location
scripts/url_shortener.py:6- Finding
Undeclared Third-Party Dependency and External Disclosure of Submitted URLs
- Content
View full analysis
- Remediation
View remediation
Security audit
Cn Url Shortener
Security checks for vulnerabilities and agentic risk
Overview
This is a plausible URL shortener, but it sends input to is.gd without clear disclosure and its documentation does not match the code.
Review before installing. Use this only for public URLs unless the maintainer adds clear is.gd disclosure, URL validation, dependency metadata, and either implements or removes the advertised alias, expiry, statistics, and batch features.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)
T09 · Insecure Skill Coding Practices
Note
- Location
scripts/url_shortener.py:18- Finding
Documented Commands Are Misinterpreted and Transmitted as URL Data
- Content
View full analysis
1 else '' print(json.dumps(shorten(url), ensure_ascii=False)) ``` The documentation advertises expiration settings, click statistics, batch generation, and a statistics command. The executable contains no subcommand parser or implementations for those features. Every first argument is instead passed directly to `shorten`. ### Technical Analysis The command-line interface does not distinguish between a URL and a command such as the documented statistics operation. It performs no URL validation and passes every first argument to the external shortening API. Consequently, a user following the documented statistics workflow does not query statistics. Instead, the command text is interpreted as a URL-like value and transmitted to is.gd. The same issue applies to malformed input and an invocation with no argument, which submits an empty value. This is an operational security and data-handling flaw rather than a demonstrated code-execution vulnerability. The discrepancy between documented and actual behavior can cause unintended external communication and makes advertised expiration and statistics controls unavailable. ### Attack Path 1. A user relies on the documentation and invokes the advertised statistics operation. 2. The script reads only `sys.argv[1]`; it does not parse a `stats` subcommand or its associated identifier. 3. The value is passed to `shorten`. 4. `shorten` transmits that value to the is.gd creation endpoint. 5. The requested statistics operation is not performed, and unintended data may be sent to the third party. ### Impact Assessment The issue does not grant elevated local privileges, ...[truncated 344 chars]- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (4)
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The natural-language content of the skill, including name, description, headings, and usage guidance, is presented only in Chinese. Under the policy rule, forcing a specific language without user opt-in or a documented regional justification is a language/locale policy violation.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The script sends the user-supplied URL to the third-party is.gd service, which can disclose sensitive internal, pre-release, or tokenized URLs to an external provider. In a skill context, this is a real privacy and data-handling issue because the transfer happens automatically with no validation, warning, consent, or restriction on what kinds of URLs may be submitted.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 78% confidence
- Finding
This markdown file describes generating short links, setting aliases, expiry, and viewing click statistics, but it provides no warning that submitted URLs may be stored, shared, or exposed through the shortening service and analytics features. For a skill that affects user data and link privacy, some user-facing disclosure is expected under the markdown-specific warning criterion.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
The inline comment is written only in Chinese, which introduces a language-specific constraint in the skill file without indicating that the skill is intentionally region-specific or offering language choice. The policy requires avoiding forced language or locale assumptions unless explicitly justified or opt-in.
- Content