Web Page Rendered HTML Content API

• Outcome: Review
• Latest audit: May 29, 2026, 9:38 PM
• Version:
  1.0.0

Overview

The skill appears to call the promised JustOneAPI rendered-HTML endpoint, but it handles the API token and user-supplied URLs in ways users should review before installing.

Install only if you are comfortable sending target URLs to JustOneAPI. Avoid private, internal, signed, or credential-bearing URLs, and prefer a revised version that reads the token from a safer secret source and sends authentication in a header rather than in command arguments or query strings.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (3)

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The skill defines the authentication token as a query parameter and automatically injects it into the request URL. Query-string secrets are commonly exposed via logs, browser/history equivalents, proxy caches, monitoring systems, error messages, and upstream server access logs, making accidental credential disclosure significantly more likely than if the token were sent in an Authorization header.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The skill requires a token and URL as query parameters but does not warn users that both are transmitted to an external third-party service. This creates a real data-handling and privacy risk because users may unknowingly send sensitive URLs, internal links, or credentials to an outside API, and placing the token in the query string can also increase exposure through logs, proxies, and monitoring systems.

Missing User Warnings

Low

• Confidence: 88% confidence
• Finding: The skill exposes an API that fetches rendered HTML for any user-supplied URL, but the documentation provides no warning about privacy, internal-network access, or server-side request risks. In an agent setting, this can enable retrieval of sensitive intranet pages, cloud metadata endpoints, or user-specific content if callers pass untrusted or attacker-influenced URLs.

VirusTotal

65/65 vendors flagged this skill as clean.