T09 · Insecure Skill Coding Practices
Error
- Location
scripts/monitor.py:340- Finding
Unrestricted URL Fetching and Webhook Destinations Enable SSRF
- Content
View full analysis
- Remediation
View remediation
Security audit
Web Monitor
Security checks for vulnerabilities and agentic risk
Overview
This is a real web-monitoring skill, but it has review-worthy risks around unvalidated imports, arbitrary URL/webhook destinations, local file writes, and dashboard script injection.
Install only if you are comfortable reviewing the code and using it with trusted monitor configurations. Avoid importing monitor JSON from untrusted sources, do not monitor local/private/internal URLs, be careful with webhook destinations and payload sensitivity, and prefer a virtual environment with pinned dependencies if you enable optional engines.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (4)
T09 · Insecure Skill Coding Practices
Error
- Location
scripts/monitor.py:2394- Finding
Stored Script Injection in the Generated Local Dashboard
- Content
View full analysis
... ` can terminate the existing script element even when it appears inside a JavaScript string. An injected HTML ` ``` 2. The victim imports the configuration using `monitor.py import`. 3. The victim runs `monitor.py gui`. 4. `_generate_gui_html()` serializes the malicious field and inserts it directly into the executable script block. 5. The browser encounters the injected ``, terminates the original block, and executes the attacker’s script. 6. Because the GUI opens automat ...[truncated 855 chars]- Remediation
View remediation
SAFE_JSON ``` 3. Escape at least `<`, `>`, `&`, U+2028, and U+2029 before embedding JSON in HTML. For example, replace `<` with `\u003c`. 4. Ensure `` cannot appear literally in any embedded data. 5. Add a restrictive Content Security Policy that blocks inline and external attacker scripts. Prefer nonce-based scripts if scripting is required. 6. Continue applying context-specific escaping when values are inserted into HTML, attributes, URLs, or JavaScript event handlers. 7. Avoid building `onclick` attributes with string concatenation; use `addEventListener`. 8. Validate imported fields and impose reasonable type and length limits. 9. Consider defaulting GUI generation to `--no-open` when untrusted imported data has not been reviewed. ]]>
T09 · Insecure Skill Coding Practices
Error
- Location
scripts/monitor.py:1921- Finding
Imported Monitor IDs Enable Path Traversal and Writes Outside the Storage Directory
- Content
View full analysis
- Remediation
View remediation
T08 · Insecure Dependencies
Warning
- Location
SKILL.md:257- Finding
Unpinned Third-Party Package and Browser Installation Instructions
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Behavioral ASTexec() Call, eval() Call, Dynamic Import
- Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
Findings (18)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 94% confidence
- Finding
The documented purpose is web monitoring, but the skill also includes behaviors that affect local state and external interactions beyond that core scope, including import/export, feedback/debug collection, and opening browser content. This mismatch can mislead users and orchestration systems about the true risk surface, causing actions with privacy or integrity implications to occur without informed consent.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 93% confidence
- Finding
The skill exposes significant capabilities (shell, network, file read/write, environment access) but does not declare any tool scope or permissions boundaries in the manifest. That creates a trust and governance gap: an agent may invoke powerful operations without explicit limitation, making misuse, accidental overreach, or unsafe execution more likely.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The invocation guidance uses broad trigger words like watch, track, monitor, and check, which can cause the skill to activate in situations where the user did not intend persistent monitoring or network access. Over-broad activation increases the chance of unintended external requests, file persistence, or state changes being performed automatically.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The webhook feature sends monitoring event data to arbitrary third-party endpoints, but the documentation does not clearly warn users that monitored page content or derived metadata may leave the local system. In a monitoring context, captured content, URLs, pricing, stock status, or change summaries may contain sensitive or proprietary information, and silent exfiltration to external endpoints is a meaningful privacy risk.
- Content
subprocess module call
Medium
- Category
- Dangerous Code Execution
- Confidence
- 70% confidence
- Finding
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
- Content
python 3. Many e-commerce sites block Python's default HTTP clients """ try: result = subprocess.run( ["curl", "-sL", "--max-time", "30", "-A", "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) " "AppleWebKit/537.36 (KHTML, like Gecko) "
subprocess module call
Medium
- Category
- Dangerous Code Execution
- Confidence
- 70% confidence
- Finding
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
- Content
python # curl try: result = subprocess.run(["curl", "--version"], capture_output=True, text=True, timeout=5) version = result.stdout.split('\n')[0].strip() if result.returncode == 0 else None if version: print(f" curl: {_green('✅ installed')} ({version.split()[1] if len(version.split()) > 1 else version})")
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The feedback feature collects local system details and constructs a GitHub issue URL embedding that data, which expands the skill's data collection beyond core web monitoring. This creates an unnecessary privacy risk because users may disclose environment details and free-form messages to an external service without strong minimization or explicit consent flow.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The feedback command stores arbitrary user messages together with system details in a persistent local log without clearly warning about retention. That can capture sensitive data users include in bug reports and leave it accessible on disk longer than expected.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
This code both persists user feedback plus system details locally and embeds the same material into a generated external GitHub issue URL, increasing the chance of accidental data disclosure. Because feedback text is free-form, users may include secrets, internal URLs, or personal data that then becomes stored and prepared for transmission outside the local system.
- Content
Tainted flow: 'feedback_log' from os.environ.get (line 1076, credential/environment) → open (file write)
Medium
- Category
- Data Flow
- Confidence
- 65% confidence
- Finding
Data from a source is assigned to a variable that is later passed to a sink, creating a variable-mediated taint flow.
- Content
python feedback_log = STORE_DIR / "feedback.log" ensure_dirs() timestamp = datetime.now(timezone.utc).isoformat() with open(feedback_log, "a", encoding="utf-8") as f: f.write(f"\n--- {timestamp} ---\n{message}\n{sys_info}\n") # Build GitHub issue URL
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The debug command inventories local environment details and prints recent feedback log contents, exposing potentially sensitive operational and user-provided data that is not strictly required for monitoring functionality. In shared terminals, logs, or support screenshots, this can leak prior messages, filesystem paths, platform details, and monitor metadata.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The debug command prints recent feedback log entries, which may include sensitive prior user messages and environment details, directly to stdout without warning. This can unintentionally expose confidential data in terminal scrollback, recordings, CI logs, or shared support sessions.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 82% confidence
- Finding
The import command can create or modify persisted monitor state from file input, but the docs do not warn users about that side effect. This can lead to accidental state changes, addition of unwanted monitored URLs or webhooks, and persistence of attacker-supplied configuration if untrusted files are imported.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
This is a markdown file, so SQP-2 applies to omitted warnings in the skill description. The examples encourage monitoring external sites, including a competitor pricing page, but provide no user-facing caution about potential policy, privacy, or site-terms implications of automated monitoring.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
SQP-3 applies to all file types and covers language or locale policy issues. The example fixes scheduling to "Africa/Johannesburg" without indicating that users may change it or that the skill is South Africa-specific, which can impose an unintended locale default.
- Content
Description-Behavior Mismatch
Low
- Category
- Not specified by scanner
- Confidence
- 83% confidence
- Finding
The manifest covers watching URLs, notifications, diffs, comparisons, templates, JS rendering, webhooks, and reporting on existing monitors. This code goes further by building a self-contained HTML console and launching it in the default browser, which is a broader UI/application behavior not reflected in the manifest description.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 75% confidence
- Finding
The HTML declares lang="en", and later date formatting uses a fixed English locale, which forces a specific language/locale presentation without user opt-in. This is a natural-language policy concern because the UI output is constrained to English formatting by default.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The JavaScript uses toLocaleDateString('en-ZA', ...) for date display, which imposes a specific regional locale on all users. The file does not provide a locale setting or explain why South African English formatting is required.
- Content
Static analysis
No suspicious patterns detected.