Markdown Fetcher

• Outcome: Pass
• Latest audit: Sep 12, 2026 · 3:29 AM UTC
• Version: 1.0.0

Overview

This is a straightforward webpage-to-Markdown helper, with caution needed for sensitive URLs and the optional unpinned Scrapling install.

Use this skill for public webpages. Do not use it with private documents, authenticated pages, internal hosts, signed links, or URLs containing tokens or secrets. If the Scrapling fallback is needed, install it in a disposable virtual environment or container and prefer a pinned, reviewed version.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:27
• Finding: Target URLs Are Disclosed to External Conversion Services<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 27–39 **Vulnerability Type**: Sensitive URL disclosure to third-party services **Risk Level**: Medium ### Vulnerable Code ```markdown 1. **首选**：`https://markdown.new/{原URL}` - 适用于 Cloudflare 托管的网站 - 示例：`https://markdown.new/https://www.nature.com/nathumbehav/` 2. **备选1**：`https://defuddle.md/{原URL}` - 如果 markdown.new 不支持 - 示例：`https://defuddle.md/https://www.nature.com/nathumbehav/` 3. **备选2**：`https://r.jina.ai/{原URL}` - 通用网页抓取服务 - 示例：`https://r.jina.ai/https://www.nature.com/nathumbehav/` ``` ### Technical Analysis The Skill instructs the agent to embed the complete target URL into a request sent to one of three external conversion providers. Consequently, the selected provider receives the original URL as part of the request path. URLs may contain sensitive information such as signed query parameters, bearer tokens, session identifiers, private document identifiers, or confidential resource names. They may also identify internal services or non-public infrastructure. The instructions do not require user consent, remove sensitive parameters, warn against processing private URLs, or restrict requests involving internal network addresses. This is an information-disclosure risk rather than evidence that the listed providers are malicious. Exposure occurs because potentially sensitive input is intentionally transmitted outside the user's environment. ### Attack Path 1. A user supplies a webpage URL containing a secret, signed parameter, private identifier, or internal hostname. 2. The agent follows the Skill and prepends a third-party conversion-service domain. 3. The agent requests the resulting conversion URL. 4. The external provider receives and may log the complete original URL. 5. Anyone with authorized or unauthorized access to the provider's request logs could potentially recover the exposed URL data. ### Impact Assessment The issue does not directly grant ...[truncated 559 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Display a clear warning and obtain explicit user consent before forwarding a URL to an external conversion service. 2. Reject URLs containing embedded credentials, fragments with secrets, or sensitive query parameters such as `token`, `key`, `signature`, `auth`, and `session`. 3. Strip unnecessary query parameters before transmission where doing so does not break access. 4. Block loopback, link-local, private, and otherwise non-public destinations, including hostnames that resolve to such addresses. 5. Avoid third-party conversion services for authenticated, confidential, or internal content; use a reviewed local parser instead. 6. Document the privacy implications, retention considerations, and trust boundaries of every external provider. 7. Apply an explicit allowlist of supported schemes and permit only validated `http` and `https` URLs. ]]>

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:41
• Finding: Unpinned Third-Party Package Installation Creates a Supply-Chain Risk<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 41–45 **Vulnerability Type**: Unpinned dependency installation and execution **Risk Level**: Medium ### Vulnerable Code ```markdown 4. **备选3**：Scrapling - 如果以上都不行，使用 GitHub 上的 Scrapling 工具 - 仓库：https://github.com/D4Vinci/Scrapling - 安装：`pip install scrapling` - 使用：`scrapling -u "URL"` ``` ### Technical Analysis The Skill directs the user or agent to install `scrapling` from the package index without pinning a reviewed version or verifying package integrity. The command may retrieve whichever release and transitive dependencies are current when it is executed. Python package installation can execute package build or installation logic. Even when installation itself is benign, the subsequent `scrapling` command executes code supplied by the installed package and its dependencies. A compromised future release, compromised maintainer account, unsafe transitive dependency, or unexpected upstream change could therefore alter the behavior after the Skill has been reviewed. The audit found no evidence that Scrapling itself is malicious. The vulnerability is the unsafe, non-reproducible dependency acquisition process. ### Attack Path 1. An upstream package release or one of its transitive dependencies is compromised or replaced with malicious code. 2. The preferred conversion services fail, causing the documented Scrapling fallback to be selected. 3. The user or agent runs `pip install scrapling`. 4. The package manager retrieves the current unpinned package and dependencies. 5. Malicious installation logic may execute during installation, or malicious runtime logic executes when `scrapling -u "URL"` is invoked. 6. The payload runs with the privileges of the account performing the installation or command execution. ### Impact Assessment A successfully compromised dependency could execute arbitrary code under the installing user's privileges. Depending on those privileges and the ...[truncated 620 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Pin Scrapling to a specifically reviewed version rather than installing the latest release. 2. Use a lockfile or requirements file containing cryptographic hashes for the package and all transitive dependencies. 3. Verify the package name, publisher, source repository, release provenance, and signatures where available. 4. Install dependencies in a dedicated virtual environment or isolated container under a non-privileged account. 5. Avoid invoking `pip` automatically from the Skill; require an explicit, reviewable dependency-provisioning step. 6. Disable unnecessary network, filesystem, and credential access while running the scraper. 7. Periodically review pinned dependencies for known vulnerabilities and update them through a controlled process. 8. Prefer a locally vendored and reviewed implementation when reproducibility and supply-chain assurance are required. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• YARA Signatures: Malware Match, Webshell Match, Cryptominer Match
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (4)

YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]

High

• Category: YARA Match

Content

---
AIGC:
    ContentProducer: Minimax Agent AI
    ContentPropagator: Minimax Agent AI
    Label: AIGC
    ProduceID: "00000000000000000000000000000000"
    PropagateID: "00000000000000000000000000000000"
    ReservedCode1: 3046022100a3d8183ddf0d0db1ba9846eee5764c57cb679d3767cf83777c8d2e8713a3b88b022100ac09929b3886c34c2be9c8378391e30dbf34f4e95ba8bbeda1821f18c53aec23
    ReservedCode2: 3045022100dc8c6fcb3a3a234c9b91c572561e8453f1040a098be4a5104c8b1147920b2f2a0220528d8ca3d0f2db47cd33f1e24ce3e273ad5259f4e167fdf1cef2b75866478b56
description: |-
    将网页内容转换为 Markdown 格式。
    当需要获取网页内容并转换为可读 Markdown 时使用此 Skill。
    优先级：markdown.new > defuddle.md > r.jina.ai > Scrapling
name: markdown-fetcher
---

# Markdown Fetcher

将网页内容转换为 Markdown

• Confidence: 80% confidence
• Finding: YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The skill routes user-supplied URLs and potentially sensitive fetched page content through third-party services such as markdown.new, defuddle.md, and r.jina.ai without warning the user. This can expose confidential URLs, internal links, access tokens embedded in query strings, or page contents to external operators, creating a privacy and data-handling risk.

Context-Inappropriate Capability

Medium

• Confidence: 86% confidence
• Finding: The manifest describes a skill for fetching webpage content and converting it to Markdown, which justifies network access to retrieval/conversion services. However, the documentation escalates to installing and running Scrapling via `pip install` and `scrapling -u`, introducing package installation and command execution capabilities that are broader than the stated purpose and not clearly justified by the manifest.

Natural-Language Policy Violations

Low

• Confidence: 84% confidence
• Finding: The natural-language instructions and usage guidance are entirely in Chinese, with no indication that the skill supports other languages or that Chinese is a required locale for a region-specific purpose. This can violate language/locale policy when no user opt-in or documented justification is provided.

Static analysis

No suspicious patterns detected.