T09 · Insecure Skill Coding Practices
Error
- Location
scripts/fetch.py:13- Finding
TLS Certificate Verification Disabled for All HTTPS Requests
- Content
View full analysis
- Remediation
View remediation
Security audit
web-to-obsidian
Security checks for vulnerabilities and agentic risk
Overview
This skill does what it says at a high level, but it fetches arbitrary URLs through third-party services with weak transport security and insufficient user warning.
Install only if you are comfortable sending article URLs to third-party conversion services and importing transformed content into Obsidian. Avoid using this with private, internal, signed, tokenized, or sensitive URLs until it validates destinations, restores normal TLS verification, uses safe temporary files, and asks before translation and external URL forwarding.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (4)
T09 · Insecure Skill Coding Practices
Error
- Location
scripts/fetch.py:66- Finding
User-Controlled URL Fetching Permits SSRF and Unsafe Redirects
- Content
View full analysis
dict: """Retrieve URL content""" req = urllib.request.Request( url, headers={ 'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.0' } ) with urllib.request.urlopen(req, timeout=timeout, context=ssl_context) as response: content = response.read().decode('utf-8', errors='ignore') return { "success": response.status == 200, "content": content, "status": response.status } ``` `scripts/smart-url.py:42-57` also probes constructed URLs without validating redirect destinations: ```python def test_url(url: str, timeout: int = 10) -> bool: """Test whether URL is available""" try: req = urllib.request.Request( url, headers={ 'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.0' }, method='HEAD' ) with urllib.request.urlopen(req, timeout=timeout, context=ssl_context) as response: return response.status == 200 except Exception: return False ``` ### Technical Analysis The scripts accept arbitrary URL strings and issue network requests without an allowlist or address-range validation. In particular, `fetch.py` directly requests the original user input after conversion servi ...[truncated 2075 chars]- Remediation
View remediation
other
Warning
- Location
scripts/fetch.py:34- Finding
Complete Source URLs Are Disclosed to Third-Party Conversion Services
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:90- Finding
Fixed Temporary Filename Can Cause File Overwrite or Symlink Abuse
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Behavioral ASTexec() Call, eval() Call, Dynamic Import
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (18)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 96% confidence
- Finding
This second mismatch finding adds that the skill may perform undeclared connectivity checks such as HEAD requests to third-party services, while still not implementing the advertised local processing and Obsidian-save features. Hidden or undocumented network activity increases the risk of data leakage, SSRF-like misuse against internal URLs, and user deception about where their content is sent.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 96% confidence
- Finding
This second mismatch finding adds that the skill may perform undeclared connectivity checks such as HEAD requests to third-party services, while still not implementing the advertised local processing and Obsidian-save features. Hidden or undocumented network activity increases the risk of data leakage, SSRF-like misuse against internal URLs, and user deception about where their content is sent.
- Content
Natural-Language Policy Violations
High
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
Automatic translation of all non-Chinese content without opt-in changes the user's data and may send potentially sensitive material to external translation services or models. In this skill context, that is more dangerous because users may expect faithful archival of the original webpage into Obsidian, not automatic transformation and possible third-party disclosure.
- Content
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The code globally disables TLS certificate validation and hostname verification for all outbound HTTPS requests. This makes requests vulnerable to man-in-the-middle interception and content tampering, allowing an attacker on the network path to alter fetched content or redirect requests without detection.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 91% confidence
- Finding
The skill instructs network fetching of arbitrary URLs via
scripts/fetch.pybut does not declare any explicit tool scope or permissions boundary. That makes the capability less auditable and can enable unintended outbound requests, including access to attacker-chosen endpoints or privacy-sensitive links, without clear user or platform constraints.- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The trigger phrases are broad enough to activate on generic requests such as saving or importing content, increasing the chance the skill runs in contexts the user did not specifically intend. Over-broad activation can lead to unexpected network fetching, translation, file writes, or data transfer to third parties without sufficiently clear consent.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The workflow explicitly instructs translation of non-Chinese content before storage, but the later file-writing instruction says the body content should not undergo any modification and should be written directly. These statements are in direct tension about whether the article body is transformed prior to saving.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The skill writes
temp.mdlocally and later deletes it, but the user-facing guidance does not clearly warn about these filesystem operations. Silent local file creation and deletion can surprise users, interfere with existing files, and reduce auditability, especially if the current working directory is not isolated.- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The skill directs the agent to run shell commands that write files, invoke an external CLI, and delete local files. Even though the stated purpose is web-to-Obsidian conversion, using unrestricted shell operations broadens the attack surface and can cause unintended filesystem changes or command misuse if values like article titles or paths are not safely handled.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The eval hard-codes that fetched content should be translated into Chinese even though the user only asked to save the article to Obsidian. This overrides user intent and can cause unauthorized transformation of source material, including loss of fidelity, licensing/compliance issues, or incorrect storage of content in a language the user did not request.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The eval requires Chinese-language output as the default behavior without offering a language choice. While not a code-execution flaw, it encodes a policy that can systematically alter user data and mis-handle multilingual content, especially when the desired archival behavior is faithful capture rather than localization.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The eval mandates translation of English content into Chinese despite the prompt only asking to store the blog post in the user's Obsidian vault. This can lead to unrequested content rewriting, semantic drift, and reduced trust in the archived note because the stored artifact is no longer a faithful copy of the original source.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The function sends user-supplied URLs to multiple third-party content-cleaning services before attempting direct retrieval. This leaks the user's requested target to external providers and expands data exposure beyond the stated purpose of simply fetching and saving a webpage to Obsidian, which is especially risky if users submit private, internal, or sensitive URLs.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
User-provided URLs are transmitted to third-party services without any warning, consent, or indication in the skill behavior. This creates a privacy and security issue because sensitive browsing targets, internal links, or tokenized URLs may be disclosed to outside operators unexpectedly.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The function rewrites any user-supplied URL to third-party reader services (r.jina.ai, markdown.new, defuddle.md), which necessarily discloses the target URL to external providers. In a skill meant to save arbitrary web pages to Obsidian, users may supply private, internal, tokenized, or sensitive URLs, so forwarding them without explicit notice or consent creates a real privacy and data-handling risk.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The availability check performs outbound requests to constructed third-party URLs solely to test reachability, again transmitting user-derived URL data externally without user awareness. This increases exposure because even fallback probing leaks browsing targets to multiple services, and the code disables SSL verification globally, weakening transport assurances during those checks.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The top-level natural-language description and comments present the tool in Chinese only, which can impose a language choice on users without opt-in. Under the policy criteria, forcing a specific language without user choice is a natural-language policy concern unless the locale restriction is explicitly justified.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 78% confidence
- Finding
The natural-language documentation strings are presented in Chinese only, with no indication that the skill is region-specific or that users may choose another language. This can conflict with language/locale policy expectations when no opt-in or justification is provided.
- Content