Web Research

• Outcome: Review
• Latest audit: Jul 13, 2026 · 10:15 AM UTC
• Version: 2.0.1

Overview

This looks like a web-research skill that also ships under-scoped CI verifier code capable of running local Python files, so users should review it before installing.

Install only if you are comfortable with both external web requests and bundled Python tooling. Do not run the CI verifier on untrusted folders unless it is isolated with no secrets, restricted network access, and disposable filesystem permissions.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (6)

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

def has_self_test(fp):
    r = subprocess.run([sys.executable, fp, "self-test"], capture_output=True, text=True, timeout=30)
    return r.returncode == 0 and "PASS" in r.stdout

• Confidence: 96% confidence
• Finding: This helper executes an arbitrary Python file discovered in the target product folder as part of verification. In CI or other trusted automation contexts, running untrusted repository code for a "self-test" can lead to arbitrary code execution, secret exfiltration, filesystem tampering, or network access under the CI runner's privileges. The use of an argument list avoids shell injection, but it does not mitigate the core risk of executing attacker-controlled code.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

all_ok &= axis(False, "frontmatter (no SKILL.md)")
        all_ok &= axis(False, "docs (no SKILL.md)")
    # 3 compiles
    comp_ok = all(subprocess.run([sys.executable, "-m", "py_compile", fp],
                                capture_output=True).returncode == 0 for fp in files)
    all_ok &= axis(comp_ok, "compiles (py_compile all .py)")
    # 4 self-test (any of 3 valid forms)

• Confidence: 94% confidence
• Finding: Although this invocation is not shell-injectable, it asks the Python interpreter to compile attacker-controlled .py files. Python compilation can trigger code in the source-encoding phase (for example via crafted codec declarations), so merely compiling untrusted files can still result in arbitrary code execution in the verifier environment. In a CI pipeline, that can expose tokens and modify artifacts.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

tests = [os.path.join(folder, f) for f in os.listdir(folder)
                 if (f.startswith("test_") or f.endswith("_test.py")) and f.endswith(".py")]
        if tests:
            st_ok = all(subprocess.run([sys.executable, t], capture_output=True, text=True,
                                      timeout=30).returncode == 0 for t in tests)
            st_note = f"{len(tests)} test_*.py"
        elif re.search(r"(?im)^test\s*:", skill_txt):

• Confidence: 97% confidence
• Finding: This code automatically executes any discovered test_*.py or *_test.py file from the target folder. An attacker can place malicious code in a test file to gain arbitrary code execution during verification, which is especially dangerous in CI because environment variables, credentials, caches, and repository write permissions may be available.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 89% confidence
• Finding: The skill advertises a self-contained CLI that performs web research, but the metadata shown in SKILL.md does not declare permissions even though the documented behavior clearly implies network access and the ability to run shell commands in CI examples. Missing permission declarations reduce user visibility into what the skill can do and can lead to unsafe execution in agent environments that rely on declared permissions for policy enforcement.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 91% confidence
• Finding: A description-behavior mismatch is dangerous because users and agent frameworks may trust the documented purpose while the underlying skill performs broader validation, test execution, scanning, or deployment-related actions. If the skill can execute tests, compile files, inspect package structure, or run CI-oriented logic beyond simple web research, it expands the attack surface and may enable unintended code execution or repository inspection under a misleading label.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill explicitly supports search and URL fetching but does not warn users that their queries and supplied URLs will be transmitted to third-party services and remote hosts. In an agent setting, this can cause inadvertent leakage of sensitive prompts, internal URLs, tokens embedded in URLs, or confidential research topics to external services.

Static analysis

No suspicious patterns detected.