T05 · Unauthorized Access and Privilege Escalation
Error
- Location
scripts/fetch.py:167- Finding
Unrestricted URL Fetching Enables Server-Side Request Forgery
- Content
View full analysis
- Remediation
View remediation
Security audit
Web Content Fetcher (WeChat images fix)
Security checks for vulnerabilities and agentic risk
Overview
The skill is a real web-content extractor, but it needs review because it can fetch arbitrary URLs from the agent environment and may send URLs to a third-party reader without clear consent or internal-url safeguards.
Install only if you are comfortable with the agent making outbound web requests from your environment. Do not use it on private, internal, authenticated, signed, or token-bearing URLs unless you have reviewed the exposure; disable or require confirmation for the Jina Reader fallback, and prefer a virtual environment with pinned dependency versions.
Vulnerability Patterns
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)
other
Warning
- Location
SKILL.md:33- Finding
Third-Party Reader Fallback Can Disclose Sensitive URLs
- Content
View full analysis
") Free tier: 200 req/day. Fast (~1-2s), good Markdown output. Does NOT work for: WeChat (403), some Chinese platforms. ``` ### Technical Analysis The fallback instructs the Agent to embed the complete target URL into a request sent to `r.jina.ai`. A URL can contain sensitive information such as: - Signed download parameters - Temporary bearer tokens - Password-reset or invitation tokens - Private document identifiers - Confidential query terms - Session or authentication data placed in query parameters When this fallback is used, the external Jina Reader service learns the target URL and may retrieve the referenced resource from its own infrastructure. The Skill does not require user consent before this disclosure, does not screen for sensitive query parameters, and does not prohibit use with private, authenticated, or capability-bearing URLs. This network transmission is not implemented in `scripts/fetch.py`; it is an instruction-level behavior that an Agent is directed to perform after a local fetch failure or missing dependency. ### Attack Path 1. A user provides a private, signed, or otherwise sensitive URL for extraction. 2. Scrapling fails, or its dependencies are unavailable. 3. The Agent follows the documented fallback instruction. 4. The Agent requests `https://r.jina.ai/`, embedding the complete original URL. 5. The third-party service receives the URL and may use any embedded token to access the underlying resource. 6. The URL and fetched content may become subject to the third party's logging, retention, and processing policies. ### Impact Assessment Potential impact includes: - Discl ...[truncated 473 chars]- Remediation
View remediation
T08 · Insecure Dependencies
Warning
- Location
requirements.txt:1- Finding
Runtime Dependencies Are Unpinned and Installed Without Integrity Verification
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (8)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 88% confidence
- Finding
The code substantially matches the core declared purpose: it fetches web pages, supports fast and stealth Scrapling modes with auto fallback, handles WeChat-specific extraction, preserves links/images/lists/code blocks through HTML-to-Markdown conversion, and extracts article-like content. However, the description claims an additional alternative extraction method using Jina Reader for simple pages, and no Jina Reader integration exists in the supplied code. This is a description-behavior mismatch because a named capability/method is declared but absent. No other significant undeclared or unrelated behaviors are present.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The README encourages automatic fetching of arbitrary URLs and documents Jina Reader as a fallback, but it does not clearly warn that this performs outbound network requests and may transmit user-supplied URLs or page access patterns to a third-party service. In an agent context, this can cause unintended disclosure of sensitive URLs, internal endpoints, or private browsing targets, especially if users assume extraction is local-only.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 92% confidence
- Finding
The skill instructs the agent to perform network-capable actions, including fetching arbitrary URLs and possibly invoking an external reader service, but it declares no explicit tool scope or permissions boundary. That creates a governance gap: the skill can be invoked for broad URL-related tasks without clear least-privilege constraints or user-visible limits on outbound requests.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The skill does not clearly warn that user-supplied URLs and retrieved page contents may be sent to external services or remote websites during extraction. This matters because the skill may contact arbitrary domains and may also use a third-party reader service, creating privacy, confidentiality, and compliance risks if users provide sensitive or internal links.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The trigger language is very broad, covering almost any request to read, fetch, scrape, extract, or summarize a URL. This can cause unintended invocation on common user requests, increasing the chance of automatic outbound requests, over-collection of remote content, or use in contexts where the user did not explicitly consent to web retrieval.
- Content
Intent-Code Divergence
Low
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The support matrix says '微信公众号 (mp.weixin.qq.com) | fast | ✅', but earlier routing guidance says the same domain should use '--stealth' because the content is JS-rendered. This is an active documentation contradiction about how the skill actually operates for a key target site.
- Content
Unpinned Dependencies
Low
- Category
- Supply Chain
- Confidence
- 91% confidence
- Finding
The dependency 'scrapling' is unpinned, so installs may pull in different versions over time, including versions with newly introduced vulnerabilities, breaking changes, or even a compromised release. Because this skill fetches and processes arbitrary web content, its attack surface is network- and parser-facing, which makes uncontrolled dependency drift more risky than in purely local tooling.
- Content
text scrapling html2text
Unpinned Dependencies
Low
- Category
- Supply Chain
- Confidence
- 88% confidence
- Finding
The dependency 'html2text' is also unpinned, allowing future installs to resolve to unexpected versions with security flaws or incompatible behavior. While this package is generally lower risk than a browser-automation or scraping stack, it still processes untrusted HTML-derived content, so supply-chain and parser-related issues remain relevant.
- Content
text scrapling html2text
Static analysis
No suspicious patterns detected.