Security audit

Clean HTTP Toolkit

Security checks for vulnerabilities and agentic risk

Overview

This HTTP toolkit is mostly what it claims to be, but it handles credentials and local files too broadly for agent use without enough warnings or safeguards.

Install only if you are comfortable with an agent making arbitrary HTTP requests and reading or writing user-specified local paths. Avoid using bearer tokens, basic auth, cookies, or sensitive files with untrusted URLs, and prefer disabling redirects or manually verifying redirect targets before sending credentials.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (4)

T09 · Insecure Skill Coding Practices

Error

Location: scripts/_common.py:80
Finding: Authentication Credentials Can Be Forwarded to a Different Origin During Redirects
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/_common.py:24
Finding: Path Validation Allows Unrestricted Local File Reads and Overwrites
Content: View full analysis
Path: if not SAFE_PATH_RE.match(p): raise ValueError(f"Refusing path with unsafe characters: {p!r}") return Path(p).expanduser() ``` Files selected with this helper can be read and transmitted: ```python # scripts/post.py:114-132 elif args.json_file: try: jp = safe_path(args.json_file) except ValueError as e: print(f"Error: {e}", file=sys.stderr) return 2 if not jp.is_file(): print(f"Error: --json-file not found: {jp}", file=sys.stderr) return 2 body = jp.read_bytes() # Validate it parses try: json.loads(body.decode("utf-8")) except (json.JSONDecodeError, UnicodeDecodeError) as e: print(f"Error: --json-file is not valid JSON: {e}", file=sys.stderr) return 2 content_type = content_type or "application/json" elif args.form: ``` Raw files are similarly loaded through `safe_path()`: ```python # scripts/post.py:145-155 elif args.raw_file: try: rp = safe_path(args.raw_file) except ValueError as e: print(f"Error: {e}", file=sys.stderr) return 2 if not rp.is_file(): print(f"Error: --raw-file not found: {rp}", file=sys.stderr) return 2 body = rp.read_bytes() ``` Output paths can create parent directories and overwrite files: ```python # scripts/_common.py:137-146 def write_or_print(out_path: Optional ...[truncated 2583 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/_common.py:107
Finding: Unbounded Response Buffering and Gzip Decompression Enable Memory Exhaustion
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/serve.py:67
Finding: Static File Server Can Expose Files Outside the Selected Directory Through Symlinks
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (11)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The declared description is for a full local HTTP client and tiny server toolkit, but the supplied code chunk does not implement any of those behaviors. It only verifies that python3 exists in the environment and prints its version. This is a materially different primary purpose, so the description does not accurately represent the actual code chunk.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The declared description presents a general-purpose HTTP client plus tiny local server toolkit, emphasizing request methods (GET/POST/PUT/PATCH/DELETE), download/resume/checksum features, and running a local test server. The supplied code chunk does not implement a general HTTP toolkit or local server behavior. Instead, it is a specialized HTML extraction tool built on top of a GET fetch helper. Its primary purpose is fetching a webpage and parsing its contents into text, title, metadata, links, images, or tables. While some overlap exists with the declared HTTP-client aspects (GET request, retries, headers, bearer auth, redirect following likely via fetch), the dominant behavior shown here is undeclared content extraction/scraping, and several prominently declared capabilities are absent from this chunk. Therefore the description does not accurately represent what this code chunk actually does.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The declared description presents a combined HTTP client and server toolkit. However, this code chunk only provides a local HTTP server with two modes: static file serving and JSON echo. That server behavior is consistent with part of the description, but the major declared client-side capabilities are absent from the supplied code. Since the actual code’s scope is materially narrower than the declared purpose, the description does not accurately represent what this specific code chunk actually does.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 92% confidence
Finding: The skill advertises capabilities that include network access and file read/write behavior, but the manifest does not declare any explicit tool scope or permissions boundaries. In an agent ecosystem, this weakens policy enforcement and can allow a seemingly simple skill to perform higher-risk actions without clear operator consent.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The skill explicitly supports authenticated HTTP requests and form/JSON submission to arbitrary endpoints, yet its documentation does not warn that tokens, credentials, and submitted data may be transmitted to remote services. In agent-driven workflows, this can lead to accidental exfiltration of secrets or sensitive user data to untrusted endpoints.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 26)May include surrounding context.
bash
# Simple GET python3 scripts/get.py https://api.example.com/users # GET with auth, query params, JSON pretty-print python3 scripts/get.py https://api.example.com/users \

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 47)May include surrounding context.
bash
# Simple GET python3 scripts/get.py https://api.example.com/users # GET with auth, query params, JSON pretty-print python3 scripts/get.py https://api.example.com/users \

External Transmission

Medium

Category: Data Exfiltration
Confidence: 84% confidence
Finding: This example shows authenticated requests using a bearer token to a remote endpoint, which normalizes sending secrets over the network without any adjacent safety warning. In an agent context, examples strongly influence behavior, and this can encourage operators or autonomous agents to transmit credentials to unintended or insufficiently trusted services.
Content: Scanner excerpt · SKILL.md (reported line 29)May include surrounding context.
md
python3 scripts/get.py https://api.example.com/users # GET with auth, query params, JSON pretty-print python3 scripts/get.py https://api.example.com/users \ --bearer "$TOKEN" \ --query 'limit=20' --query 'page=1' \ --json

External Transmission

Medium

Category: Data Exfiltration
Confidence: 83% confidence
Finding: This example demonstrates posting JSON data, including personal information and an authorization token, to a remote API without any cautionary note. That increases the risk of accidental disclosure of PII or credentials when the skill is used by agents that may follow examples literally.
Content: Scanner excerpt · SKILL.md (reported line 38)May include surrounding context.
md
python3 scripts/get.py https://example.com --status-only # POST JSON python3 scripts/post.py https://api.example.com/users \ --json '{"name":"Alice","email":"alice@example.com"}' \ --bearer "$TOKEN"

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 84% confidence
Finding: This code returns a JSON envelope containing all request headers and the parsed request body, which can include credentials, tokens, cookies, or other sensitive data sent by the client. Although the module docstring says echo mode is useful for inspecting what an agent is sending, it does not explicitly warn users that potentially sensitive request data will be captured and reflected.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Low

Category: Not specified by scanner
Confidence: 85% confidence
Finding: The docstring states that there are no remote calls beyond what the user explicitly asks for. However, fetch() follows redirects by default via urllib unless follow_redirects is disabled, which can cause additional network requests to different URLs than the original user-provided target. This is a documentation-to-behavior mismatch in the file's stated intent.
Content: No source excerpt is available for this finding.

Static analysis

Detected: suspicious.insecure_tls_verification

HTTPS certificate verification is disabled.

Warn

Code: suspicious.insecure_tls_verification
Location: scripts/_common.py:98

HTTPS certificate verification is disabled.

Warn

Code: suspicious.insecure_tls_verification
Location: scripts/download.py:110