Clean Content Fetch

• Outcome: Pass
• Latest audit: Sep 11, 2026 · 9:23 AM UTC
• Version: 1.0.5

Overview

This skill is a public web-page content extraction helper with disclosed boundaries, but its install steps use unpinned packages and the referenced scripts are not included in the artifact.

Install only in an isolated project environment, consider pinning and reviewing dependencies first, and do not use this skill with logged-in sessions, private pages, credentials, or restricted content. Because the referenced implementation scripts are absent, verify any script obtained separately before running it.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:35

Finding

Unpinned Third-Party Dependencies and Browser Installation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 35–42
Vulnerability Type: Unpinned third-party packages and browser artifacts
Risk Level: Medium

Vulnerable Code

bash

python3 -m venv .venv
. .venv/bin/activate
pip install scrapling html2text curl_cffi playwright browserforge
python -m playwright install chromium

Technical Analysis

The documented installation procedure retrieves five Python packages without version constraints, package hashes, a lock file, or repository integrity requirements. It then uses Playwright to download and install a Chromium binary without pinning or documenting verification of the resulting artifact.

These dependencies are relevant to the declared webpage-extraction functionality, and the instructions appropriately recommend a project-level virtual environment. However, a virtual environment only limits Python package placement; it does not prevent package installation or build logic from executing with the invoking user's privileges.

Because dependency names resolve to mutable releases from the user's configured package index, the reviewed Skill does not uniquely identify the code that will be installed. A compromised package release, transitive dependency, package repository, or index configuration could consequently introduce attacker-controlled code after this Skill has been reviewed.

The referenced implementation scripts are absent from the supplied artifact. Therefore, no direct malicious execution was confirmed, but the documented installation process creates a supply-chain exposure.

Attack Path

1. A user follows the setup instructions in SKILL.md.
2. pip resolves the latest compatible versions of the named packages and their transitive dependencies from the configured package index.
3. A compromised or substituted distribution is downloaded.
4. Malicious build, installation, import, or runtime logic executes under the user's account.

...[truncated 842 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin every direct dependency to a reviewed, exact version.
2. Resolve and lock all transitive dependencies using a reproducible lock file.
3. Record cryptographic hashes and install with hash verification, such as pip install --require-hashes -r requirements.txt.
4. Explicitly configure and document trusted package indexes rather than relying on arbitrary user configuration.
5. Pin the Playwright version and corresponding Chromium revision.
6. Verify downloaded browser artifacts through the integrity mechanism provided by the upstream distributor.
7. Perform installation and execution in a sandbox or container with restricted filesystem access, no unnecessary credentials, and narrowly scoped network access.
8. Include the referenced scripts/scrapling_fetch.py and scripts/fetch-web-content files in the package so their behavior can be reviewed before release.
9. Add automated dependency scanning and reproducible-installation checks to the release process.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

This markdown file contains user-facing natural-language instructions entirely in Chinese, and there is no indication that users may choose another language or that the skill is intentionally restricted to a Chinese-language context. Under the policy, forcing a specific language without opt-in is a natural-language policy violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 78% confidence

Finding

The file presents the skill description in fixed Chinese and English sections, but it does not state whether the skill supports user language preference or locale selection. Because language/locale policy findings apply to natural-language constraints, this could be read as a documentation-level assumption about output language without explicit opt-in.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.