Web Monitor

• Outcome: Pass
• Latest audit: May 28, 2026 · 1:19 PM UTC
• Version: 3.5.0

Overview

This is a coherent web page monitoring skill that stores monitor data locally and only sends webhook or diagnostic data when the user configures or invokes those features.

Install only if you are comfortable with a local tool storing monitored URLs and page snapshots under ~/.web-monitor. Be careful with webhook destinations because monitored URLs and change details leave your machine, and review debug or feedback output before sharing it because it can include local system details or prior feedback text.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (7)

Tainted flow: 'feedback_log' from os.environ.get (line 1076, credential/environment) → open (file write)

Medium

• Category: Data Flow

Content

feedback_log = STORE_DIR / "feedback.log"
    ensure_dirs()
    timestamp = datetime.now(timezone.utc).isoformat()
    with open(feedback_log, "a", encoding="utf-8") as f:
        f.write(f"\n--- {timestamp} ---\n{message}\n{sys_info}\n")

    # Build GitHub issue URL

• Confidence: 78% confidence
• Finding: The write target is derived from WEB_MONITOR_DIR, an environment-controlled path, and the program appends feedback content there without validating the location. In contexts where an attacker can influence the environment or execution wrapper, this can cause writes outside the intended application directory, potentially overwriting or planting files accessible to the current user.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 87% confidence
• Finding: The skill advertises and documents capabilities that read/write local files, access the network, invoke shell commands, and potentially inspect environment-dependent tooling, but it declares no permissions. That mismatch prevents informed consent and weakens sandbox/policy enforcement, especially because the skill stores data under ~/.web-monitor, fetches arbitrary URLs, opens browsers, and supports webhooks.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 80% confidence
• Finding: The documented behavior extends beyond simple web monitoring into feedback logging, debug output, import/export, and generating/opening a local GUI, which increases data handling and execution surface beyond the stated purpose. While not inherently malicious, undisclosed ancillary behaviors can expose local data, surprise users, and create unintended exfiltration or privacy risks when combined with stored monitor contents and debug logs.

Context-Inappropriate Capability

Medium

• Confidence: 82% confidence
• Finding: The debug command prints local system metadata and recent feedback log contents directly to stdout. In agent or shared-terminal contexts, that can expose sensitive local details or user-supplied feedback contents to downstream logs, transcripts, or other observers beyond the intended troubleshooting use.

Vague Triggers

Medium

• Confidence: 76% confidence
• Finding: The invocation guidance is broad enough that the skill may activate for many ordinary requests involving checking websites, tracking items, or updates, increasing the chance it runs without the user understanding it will persist monitors, fetch remote content, or send webhooks. This is primarily a safety and consent issue rather than a direct exploit, but it can lead to over-collection and unintended external requests.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The skill supports sending JSON payloads with monitor metadata, URLs, event details, and potentially page-derived information to arbitrary webhook endpoints, but the description does not clearly warn users that monitored data leaves the local system. In this context, that omission is significant because users may monitor sensitive or account-specific pages, and arbitrary endpoints could receive private URLs, pricing, or content-derived summaries.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: Webhook POSTs transmit monitor identifiers, labels, monitored URLs, timestamps, and event details to arbitrary configured endpoints. Because execution-time output does not prominently warn that monitored URLs and event metadata are being sent off-host, users may unintentionally disclose browsing targets, commercial interests, or other sensitive monitoring activity.

VirusTotal

64/64 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.