T09 · Insecure Skill Coding Practices
Error
- Location
scripts/scan.py:253- Finding
Server-Side Request Forgery Through Unvalidated Sitemap URLs
- Content
View full analysis
- Remediation
View remediation
Security audit
Web Site or Domain Name Basic Information Scanner
Security checks for vulnerabilities and agentic risk
Overview
The skill is a coherent website scanner, but it needs review because scanned sites can steer it into making unintended outbound requests from the user's environment.
Review before installing. Use this only against public or authorized targets, preferably from an isolated environment with restricted egress, because a scanned site can influence follow-up requests through sitemap data. Avoid scanning internal domains or sensitive investigations unless third-party lookups and outbound disclosure are acceptable.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Behavioral ASTexec() Call, eval() Call, Dynamic Import
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (19)
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 95% confidence
- Finding
The skill clearly instructs use of network access, shell commands, and report output, but it declares no explicit tool scope or permissions boundary. In an agent setting, this can lead to over-broad execution authority, making it easier for the skill to trigger unexpected network calls, shell execution, or file writes without transparent user consent or enforcement.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The description presents comprehensive website scanning and third-party checks without warning that user-supplied domains and page content will be transmitted to external systems such as DNS resolvers, WHOIS servers, websites being scanned, search engines, or optional third-party services. This creates a privacy and operational risk because sensitive targets or investigation intent may be disclosed during scanning.
- Content
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
"dig command not found"
bash # Ubuntu/Debian sudo apt-get install dnsutils # macOS brew install bind
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
"dig command not found"
bash # Ubuntu/Debian sudo apt-get install dnsutils # macOS brew install bind
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
"dig command not found"
bash # Ubuntu/Debian sudo apt-get install dnsutils # macOS brew install bind
subprocess module call
Medium
- Category
- Dangerous Code Execution
- Confidence
- 70% confidence
- Finding
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
- Content
python for record_type in cls.RECORD_TYPES: try: result = subprocess.run( ["dig", "+short", "-t", record_type, domain], capture_output=True, text=True,
subprocess module call
Medium
- Category
- Dangerous Code Execution
- Confidence
- 70% confidence
- Finding
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
- Content
python def query_whois(domain: str) -> Dict: """Query WHOIS data for domain""" try: result = subprocess.run( ["whois", domain], capture_output=True, text=True,
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The scanner automatically performs multiple external lookups to third parties and target-controlled endpoints, including ipapi.co, Google, DNS/WHOIS infrastructure, and optionally sitemap-derived pages, without a clear user-facing disclosure or consent boundary. In a security-tool context, this can unintentionally leak the target being investigated, the operator's IP/user agent, and internal or sensitive domains if users scan non-public assets.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The manifest explicitly states that deep scanning supports Playwright for client-side rendered pages, but the deep scan code only performs additional plain HTTP GET requests with requests/BeautifulSoup and extracts static HTML titles. There is no Playwright import, browser automation, or JavaScript-rendered page handling anywhere in this file, so the advertised capability is not actually implemented.
- Content
Unpinned Dependencies
Low
- Category
- Supply Chain
- Confidence
- 96% confidence
- Finding
The dependency is specified with a lower bound only, which allows future installs to resolve to different versions over time. This weakens reproducibility and can unintentionally introduce vulnerable or breaking releases, especially for a network-facing scanning tool that relies on HTTP functionality.
- Content
text requests>=2.28.0 beautifulsoup4>=4.11.0 lxml>=4.9.0 reportlab>=3.6.0
Unverifiable Dependency: requests has 16 known advisory(ies) (CVE-2014-1830 (Exposure of Sensitive Information to an Unauthorized Actor in Requests); CVE-2024-47081 (Requests vulnerable to .netrc credentials leak via malicious URLs); CVE-2024-35195 (Requests `Session` object does not verify requests after making first request wi) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected
Low
- Category
- Supply Chain
- Confidence
- 93% confidence
- Finding
Because requests is not pinned, there is no way to verify from this manifest whether the installed version includes fixes for known advisories. In a website scanning tool that makes outbound HTTP requests, dependency ambiguity increases the chance that a vulnerable build is deployed and exposed to attacker-controlled URLs or responses.
- Content
Unpinned Dependencies
Low
- Category
- Supply Chain
- Confidence
- 95% confidence
- Finding
Using an unpinned beautifulsoup4 version makes builds non-deterministic and may pull in newer releases without prior testing. While not inherently exploitable by itself, it increases supply-chain and stability risk for the skill's web-content parsing functionality.
- Content
text requests>=2.28.0 beautifulsoup4>=4.11.0 lxml>=4.9.0 reportlab>=3.6.0
Unpinned Dependencies
Low
- Category
- Supply Chain
- Confidence
- 98% confidence
- Finding
lxml is unpinned even though it is a complex parser with a history of security advisories. In a website scanning skill that parses remote HTML/XML content, allowing arbitrary future versions increases the chance of introducing parser-related vulnerabilities or regressions into production.
- Content
text requests>=2.28.0 beautifulsoup4>=4.11.0 lxml>=4.9.0 reportlab>=3.6.0
Unverifiable Dependency: lxml has 14 known advisory(ies) (CVE-2021-43818 (lxml's HTML Cleaner allows crafted and SVG embedded scripts to pass through); CVE-2014-3146 (lxml Cross-site Scripting Via Control Characters); CVE-2021-28957 (lxml vulnerable to Cross-Site Scripting ) +11 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected
Low
- Category
- Supply Chain
- Confidence
- 97% confidence
- Finding
The manifest does not prove which lxml release will be installed, despite lxml having multiple historical advisories. Given this skill parses remote website content, any unresolved parser or sanitizer flaws in the installed version could become reachable through attacker-supplied HTML/XML data.
- Content
Unpinned Dependencies
Low
- Category
- Supply Chain
- Confidence
- 98% confidence
- Finding
reportlab is specified with only a minimum version, so installs may resolve to unknown releases, including ones with security issues. This is more concerning because reportlab has had high-impact bugs historically, and PDF/report generation often processes untrusted content gathered from scanned websites.
- Content
text requests>=2.28.0 beautifulsoup4>=4.11.0 lxml>=4.9.0 reportlab>=3.6.0
Unverifiable Dependency: reportlab has 8 known advisory(ies) (CVE-2023-33733 (Reportlab vulnerable to remote code execution); CVE-2020-28463 (Server-side Request Forgery (SSRF) via img tags in reportlab); CVE-2019-19450 (ReportLab vulnerable to remote code execution via paraparser) +5 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected
Low
- Category
- Supply Chain
- Confidence
- 98% confidence
- Finding
reportlab has known high-impact advisories, and the unpinned requirement means the deployed version cannot be verified as safe. This matters more in this skill because scanned website content may later be embedded into generated reports, potentially exposing PDF generation paths to untrusted input.
- Content
Intent-Code Divergence
Low
- Category
- Not specified by scanner
- Confidence
- 81% confidence
- Finding
The function documentation suggests a straightforward WHOIS query, but the implementation parses and returns specific registrant organization and country fields in addition to basic domain data. While related to WHOIS, the docstring understates the collection of registrant-identifying information.
- Content
Intent-Code Divergence
Low
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The docstrings for fetch_robots_txt and fetch_llms_txt say 'Fetch and parse', which implies structured interpretation of these files. In reality, both functions only download the file and return raw text slices or status strings, with no parsing logic beyond simple retrieval.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The JSON report function writes directly to a user-supplied filename, and the PDF report function likewise creates output files, but there is no confirmation prompt or warning that existing files may be overwritten. The operation is not destructive in a severe sense, but it is a file write affecting local user data without clear disclosure at the point of action.
- Content