Sitemap Generator

• Outcome: Review
• Latest audit: Sep 11, 2026 · 6:08 PM UTC
• Version: 1.0.0

Overview

This is a straightforward sitemap crawler, but it can be directed or redirected to private/internal network targets without safeguards.

Install in a virtual environment and run it only against sites you own or trust. Avoid using it in environments with access to sensitive internal services unless private, loopback, link-local, reserved, and cloud metadata addresses are blocked and redirects are validated or disabled.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/sitemap_gen.py:79
• Finding: Unrestricted Network Targets and Redirects Permit Server-Side Request Forgery## Vulnerability Details **File Location**: `scripts/sitemap_gen.py`, lines 79 and 160–164 **Vulnerability Type**: Server-Side Request Forgery (SSRF) through unrestricted URLs and redirects **Risk Level**: Medium ### Vulnerable Code ```python resp = requests.get(url, headers=headers, timeout=timeout, allow_redirects=True) ``` The initial URL validation does not restrict destinations or URL schemes: ```python # Validate URL parsed = urlparse(args.url) if not parsed.scheme or not parsed.netloc: print("ERROR: Invalid URL. Include scheme (https://example.com)", file=sys.stderr) sys.exit(1) ``` ### Technical Analysis The crawler accepts any URL containing a scheme and network location. It does not explicitly restrict the scheme to HTTP or HTTPS, resolve and inspect the destination address, or reject loopback, private, link-local, reserved, and cloud metadata addresses. Furthermore, `allow_redirects=True` causes `requests` to follow redirects without validating each redirect destination. Consequently, an apparently safe public URL can redirect the crawler to an internal service. The same-domain check applied to discovered HTML links does not protect the request that has already followed the redirect. This creates an SSRF condition whenever an untrusted party can influence the starting URL or the redirect behavior of a crawled server. ### Attack Path 1. An attacker supplies a public HTTP or HTTPS URL to the user or Agent. 2. The crawler accepts the URL because it has a scheme and network location. 3. The attacker-controlled public server returns an HTTP redirect to a loopback, private-network, link-local, or cloud metadata address. 4. `requests.get(..., allow_redirects=True)` follows the redirect automatically. 5. The crawler issues a GET request to the internal destination from the privileges and network context of the host running the skill. 6. The internal endpoint may disclose information throug ...[truncated 873 chars]
• Remediation: ## Remediation Suggestions 1. Explicitly allow only `http` and `https` URL schemes. 2. Resolve the destination hostname before every request and reject loopback, private, link-local, multicast, unspecified, and reserved IP address ranges. 3. Disable automatic redirects and process redirects manually. 4. Resolve and validate the destination of every redirect before following it. 5. Protect against DNS rebinding by ensuring the validated address is the address actually used for the connection. 6. Block known metadata destinations, including link-local cloud metadata addresses. 7. Consider requiring an explicit operator option before private-network crawling is permitted. 8. Apply outbound firewall or proxy restrictions so the crawler cannot access sensitive internal services.

T08 · Insecure Dependencies

Note

• Location: SKILL.md:61
• Finding: Unpinned Third-Party Dependencies Create Supply-Chain Risk## Vulnerability Details **File Location**: `SKILL.md`, line 61 **Vulnerability Type**: Unpinned and unverifiable third-party dependencies **Risk Level**: Low ### Vulnerable Code ```bash pip install requests beautifulsoup4 ``` ### Technical Analysis The documented installation command retrieves unconstrained versions of `requests` and `beautifulsoup4`. The project does not provide a dependency lockfile, version constraints, or package hashes. As a result, installation is not reproducible: the code installed by a user can differ from the dependency versions considered during this audit. Future upstream changes, a compromised package release, package-index compromise, or an incompatible release could alter runtime behavior without changes to this project. The package names shown are established packages and there is no evidence in the reviewed project that either dependency is currently malicious. The issue is the absence of integrity and version controls rather than evidence of an existing dependency compromise. ### Attack Path 1. A user follows the installation command in `SKILL.md`. 2. `pip` resolves the newest dependency versions permitted by the environment at installation time. 3. If a dependency release or configured package source has been compromised, the affected package is downloaded without a project-controlled version or hash verification. 4. Malicious package code may execute during installation or when imported by `sitemap_gen.py`. 5. That code runs with the filesystem, network access, environment variables, and operating-system privileges of the user running the installation or crawler. Exploitation depends on a compromised package release, package repository, or package-source configuration; no such compromise was identified in the reviewed files. ### Impact Assessment A malicious dependency would execute with the privileges of the installing or invoking user. It could potentially access files av ...[truncated 357 chars]
• Remediation: ## Remediation Suggestions 1. Pin all direct dependencies to versions that have been reviewed and tested. 2. Provide a lockfile that records resolved transitive dependency versions. 3. Record cryptographic package hashes and install with `pip install --require-hashes`. 4. Install dependencies from the official package index or another explicitly trusted repository. 5. Recommend installation in a dedicated, non-privileged virtual environment. 6. Use automated dependency vulnerability scanning and regularly review controlled version updates. 7. Avoid installing project dependencies with root or administrator privileges.

SkillSpector

Vulnerability Patterns

• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 97% confidence
• Finding: The skill instructs users to run a network-capable crawler but does not declare any tool scope such as permissions or allowed-tools. This creates an authorization gap: an agent may be induced to make outbound requests without explicit restriction, enabling unintended network access, internal endpoint probing, or use against arbitrary targets if the skill is invoked in a broader agent environment.

Static analysis

No suspicious patterns detected.