Security audit

URL Fetcher

Security checks for vulnerabilities and agentic risk

Overview

This skill fetches web pages as advertised, but its safety checks for internal URLs and file writes are too weak for the security claims it makes.

Review before installing in sensitive environments. Use it only for trusted public URLs, avoid running it where cloud metadata or internal HTTP services are reachable, and save output only to a dedicated scratch directory. Do not rely on its current checks to block all internal destinations or protect important files from overwrite.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Error

Location: scripts/url_fetcher.py:45
Finding: SSRF Protection Can Be Bypassed to Access Internal Network Resources
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/url_fetcher.py:21
Finding: Overly Broad and Fragile Path Validation Allows Sensitive File Overwrites
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Output HandlingUnvalidated Output Injection, Cross-Context Output, Unbounded Output
Rogue AgentSelf-Modification, Session Persistence
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (3)

Unvalidated Output Injection

High

Category: Output Handling
Confidence: 85% confidence
Finding: Model output is used without validation or sanitization. Unvalidated output injected into downstream contexts (SQL, shell, HTML) enables injection attacks and arbitrary code execution.
Content: Scanner excerpt · SKILL.md (reported line 196)May include surrounding context.
md
output.parent.mkdir(parents=True, exist_ok=True) # Fetch subprocess.run([ "python3", "/path/to/url_fetcher.py", "fetch",

Session Persistence

Medium

Category: Rogue Agent
Confidence: 80% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · SKILL.md (reported line 134)May include surrounding context.
Combine with task-runner:

bash
# Add task to fetch content task_runner.py add "Fetch article on topic X" "research" # Fetch when ready

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill encourages fetching arbitrary remote URLs but does not clearly warn users that doing so sends the requested target, IP address, headers/User-Agent, and timing metadata to external servers. In an agent setting, this omission can cause accidental disclosure of sensitive research targets or internal investigation activity, even if the fetcher itself is otherwise functioning as described.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.