Cn Web Clipper

• Outcome: Review
• Latest audit: Sep 16, 2026 · 6:43 AM UTC
• Version: 1.2.7

Overview

The web clipper mostly does what it says, but it also exposes under-documented cloud output modes and credential handling that warrant review before installation.

Install only if you are comfortable with the skill making outbound requests to supplied URLs and saving extracted content locally. Avoid running it against untrusted or internal URLs in privileged environments, and do not expose Feishu credentials unless the cloud integration has been reviewed and actually implemented.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (3)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/clip_webpage.py:50

Finding

Arbitrary URL Fetching Enables Server-Side Request Forgery

Content

View full analysis

Vulnerability Details

File Location: scripts/clip_webpage.py, lines 50–51, with attacker-controlled input entering through lines 215 and 220
Vulnerability Type: Server-Side Request Forgery (SSRF)
Risk Level: High

python

resp = requests.get(url, headers=headers, timeout=30)
resp.raise_for_status()

The request target originates directly from a command-line argument:

python

parser.add_argument('url', help='要剪藏的网页URL')
...
data = extract_content(args.url)

Technical Analysis

The application sends an HTTP request to an arbitrary user-supplied URL without validating its scheme, hostname, resolved IP address, port, or redirect destinations. The requests library follows redirects by default, so validating only the initial URL would also be insufficient.

An attacker can provide URLs targeting loopback interfaces, private network ranges, link-local services, IPv6 local addresses, or cloud instance metadata endpoints. DNS rebinding and redirects can also be used to bypass simplistic hostname checks. The response is processed as a webpage, partially printed to standard output, and may be written to a local Markdown file.

No response-size limit is applied beyond the 30-second timeout, which can additionally expose the process to excessive memory consumption when a remote endpoint returns a very large response.

Attack Path

1. The attacker supplies a URL such as a loopback address, a private-network service, or a cloud metadata endpoint.
2. The command-line value is passed unchanged from args.url to extract_content().
3. requests.get() initiates the request from the host running the Skill.
4. If the target redirects, the library follows the redirect without validating the new destination.
5. The response content is parsed by Readability and BeautifulSoup.
6. Extracted internal content is displayed in the excerpt or persisted to a Markdown file, allowing the attacker or caller ...[truncated 645 chars]

Remediation

View remediation

Remediation Suggestions

• Parse URLs before making requests and permit only explicitly supported http and https schemes.
• Reject URLs containing embedded credentials, malformed hostnames, or unsupported ports.
• Resolve the destination hostname and reject every address in loopback, private, link-local, multicast, reserved, unspecified, and carrier-grade NAT ranges for both IPv4 and IPv6.
• Either disable redirects with allow_redirects=False or manually process each redirect and repeat complete URL and resolved-address validation before following it.
• Consider using an explicit hostname allowlist when the operational use case permits it.
• Route outbound requests through a restricted proxy or network policy that cannot reach internal services or metadata endpoints.
• Stream responses and enforce a conservative maximum response size and content type.
• Revalidate the connected destination to mitigate DNS rebinding and time-of-check/time-of-use discrepancies.

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: scripts/clip_webpage.py:169

Finding

Undocumented Cloud Integration Accesses Sensitive Credentials Beyond the Declared Scope

Content

View full analysis

Vulnerability Details

File Location: scripts/clip_webpage.py, lines 169–181; related optional imports at lines 21–32 and output selection at lines 212–213
Vulnerability Type: Excessive and undocumented credential access
Risk Level: Medium

python

app_id = os.environ.get('FEISHU_APP_ID')
app_secret = os.environ.get('FEISHU_APP_SECRET')

if not app_id or not app_secret:
    return {'error': '缺少FEISHU_APP_ID或FEISHU_APP_SECRET环境变量'}

try:
    client = FeishuClient(app_id, app_secret)

The integration is exposed through an output option:

python

parser.add_argument('--output', '-o', choices=['markdown', 'feishu', 'notion'], 
                   default='markdown', help='输出格式')

The third-party client is loaded conditionally:

python

try:
    from feishu_api import FeishuClient
    FEISHU_AVAILABLE = True
except ImportError:
    pass

Technical Analysis

The documented Skill purpose is webpage extraction and local Markdown storage, but the implementation exposes undocumented Feishu and Notion integration modes. Selecting Feishu output causes the process to read FEISHU_APP_ID and FEISHU_APP_SECRET from its environment and pass them to an optional third-party client constructor.

This violates least-privilege design because cloud credentials are accessed for functionality not declared in the Skill documentation. The relevant third-party client implementation is not included in the audited project, so its constructor behavior and handling of the credentials cannot be verified here.

The Feishu function does not perform the stated upload. It constructs a client and then returns a fabricated document URL. Consequently, sensitive credentials are accessed and entrusted to external code even though no real persistence operation is implemented.

Attack Path

1. The execution environment contains Feishu application credentials.
2. A caller invokes the script with ` ...[truncated 1114 chars]

Remediation

View remediation

Remediation Suggestions

• Remove the Feishu and Notion integrations unless they are required and fully implemented.
• Document every cloud integration, credential requirement, network action, and granted permission in SKILL.md.
• Move each integration into a separate opt-in module so local Markdown clipping never imports cloud client packages or accesses cloud credentials.
• Read credentials only immediately before a real, explicitly requested operation.
• Require clear user confirmation before sending extracted content to a third-party service.
• Use narrowly scoped credentials dedicated to this Skill and avoid broad tenant-wide privileges.
• Audit and pin the exact client package before passing secrets to it.
• Replace the simulated Feishu result with a real, verified API response or return an explicit “not implemented” error.
• Reject --output notion until that output path is implemented; do not return a successful result when no save action occurred.

T08 · Insecure Dependencies

Warning

• Location: scripts/clip_webpage.py:15

Finding

Unpinned, Incomplete, and Ambiguous Third-Party Dependency Configuration

Content

View full analysis

Vulnerability Details

File Location: scripts/clip_webpage.py, lines 15–32 and line 166; dependency documentation in SKILL.md, lines 22–24
Vulnerability Type: Unpinned and incompletely documented dependencies
Risk Level: Medium

python

import requests
from bs4 import BeautifulSoup
from readability import Document

FEISHU_AVAILABLE = False
try:
    from feishu_api import FeishuClient
    FEISHU_AVAILABLE = True
except ImportError:
    pass

NOTION_AVAILABLE = False
try:
    from notion_client import Client as NotionClient
    NOTION_AVAILABLE = True
except ImportError:
    pass

Runtime installation guidance is also returned for an unpinned package:

python

return {'error': '飞书API未安装，请运行: pip install feishu-api'}

The dependency documentation lists only:

markdown

## 依赖
- Python 3.7+
- requests, beautifulsoup4

Technical Analysis

The project has no reviewed dependency manifest or lockfile specifying exact package versions and integrity hashes. The documentation omits the mandatory package that provides readability.Document and does not document the optional Notion dependency. It also instructs users to install feishu-api without a version constraint or integrity verification.

Package imports execute package initialization code in the local Python environment. Installing ambiguous or unpinned package names therefore introduces a supply-chain execution path. Dependency confusion, package-name ambiguity, a compromised release, or an unsafe transitive dependency could result in arbitrary code execution during installation or import.

The generic readability import is particularly important to identify using an exact canonical distribution name because multiple similarly named packages may expose different APIs. The audit does not establish that any currently referenced package is malicious; the confirmed issue is the unsafe and non-reproducible d ...[truncated 1242 chars]

Remediation

View remediation

Remediation Suggestions

• Create a dependency manifest and a reviewed lockfile containing exact versions and cryptographic hashes.
• Document every mandatory and optional dependency, including the exact canonical distribution name corresponding to each imported module.
• Verify package ownership, provenance, release history, and repository links before adoption.
• Remove inline instructions that recommend unrestricted pip install commands.
• Install dependencies from an approved package index using hash verification, such as pip install --require-hashes.
• Separate optional cloud integrations into extras so local operation does not require or import them.
• Use automated dependency vulnerability and provenance scanning in continuous integration.
• Regularly update locked versions through a controlled review and testing process rather than resolving the newest release at runtime.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (4)

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 90% confidence

Finding

The skill advertises code-driven behavior that can access the network and write local files, but it does not declare any explicit tool scope or permissions. This creates a trust and review gap: users and hosting platforms cannot easily see that the skill will fetch remote content and persist it locally, increasing the chance of unintended data exposure or unsafe execution in broader-than-expected environments.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The description explains that webpages are clipped and saved as Markdown, but it does not clearly warn users that the skill performs live network fetches and writes content to local storage. Without an explicit warning, users may supply sensitive URLs or run the skill in environments where local persistence or outbound requests are not expected, leading to privacy, compliance, or storage-safety issues.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

This code file contains natural-language descriptions and CLI output exclusively in Chinese, including the module docstring and later user-facing help/messages. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale restriction is clearly documented and justified, which is not present here.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The natural-language title, description, and usage context are written in Chinese, which may effectively force a specific language without user opt-in. The file does not indicate that the skill is region-specific or provide an alternative language option.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.