T09 · Insecure Skill Coding Practices
Error
- Location
core/crawl_runner.py:84- Finding
Unrestricted URL Fetching Enables Server-Side Request Forgery
- Content
View full analysis
- Remediation
View remediation
Security audit
Kekik Crawler
Security checks for vulnerabilities and agentic risk
Overview
This is a real web crawler, but it can follow untrusted links to arbitrary network locations and its research presets disable robots.txt checks by default.
Install only in an isolated environment with limited network reach, avoid running it where localhost, private network services, or cloud metadata endpoints are accessible, review or change the presets to respect robots.txt, and pin dependencies before operational use. Treat person-research outputs and the SQLite cache as potentially sensitive because crawled content is stored locally.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)
T08 · Insecure Dependencies
Warning
- Location
requirements.txt:1- Finding
Unpinned Dependencies Permit Unreviewed Supply-Chain Changes
- Content
View full analysis
=0.3.21 tenacity>=8.2.3 orjson>=3.10.0 scrapling>=0.2.96 ``` `SKILL.md:10-14` instructs users to install those unconstrained dependencies: ```markdown ## Quick Start ```bash pip install -r requirements.txt python main.py --urls https://example.org ``` ``` `README.md:16-19` provides the same installation path: ```markdown ## Kurulum ```bash pip install -r requirements.txt ``` ``` ### Technical Analysis Each requirement uses `>=` without an upper bound, exact version, lock file, or integrity hash. A fresh installation can therefore resolve to dependency releases that did not exist when the project was reviewed. Python packages may execute code during build or installation, and imported packages execute module initialization code at runtime. In particular, the crawler directly imports functionality from these packages, including the network-fetching backend. Compromise of an upstream package, maintainer account, package index, or future release could therefore introduce code that runs with the privileges of the user installing or launching the crawler. No evidence was found that the currently named packages are malicious. The finding concerns the project's inability to reproduce and authenticate a reviewed dependency set. ### Attack Path 1. A listed package or one of its transitive dependencies publishes a compromised or otherwise malicious future version. 2. A user follows the documented `pip install -r requirements.txt` instruction. 3. Because only a minimum version is specified, the resolver selects the newer unreviewed release. 4. Malicious code executes during package build, installation, or later import. 5. That code runs with the permissions and ac ...[truncated 1030 chars]- Remediation
View remediation
Vulnerability Patterns
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (16)
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
This progress file uses Turkish throughout for status headings and descriptions, which imposes a specific language on readers without any indication of user opt-in or a documented regional constraint. Under the policy rule, forcing a specific language without offering choice or justification is a natural-language policy violation.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 82% confidence
- Finding
This markdown file documents a crawler that performs web research and writes results to output files, including examples involving a person's name, but it does not warn users about collecting, storing, or handling potentially sensitive personal data. For markdown files, SQP-2 applies when the skill description omits warnings about behaviors that could affect user data, privacy, or system integrity.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 95% confidence
- Finding
The skill documentation declares no explicit tool scope even though the skill’s described behavior clearly implies network access plus file read/write for crawling, checkpointing, and output generation. Missing permission boundaries increases the chance that an agent runtime grants broader capabilities than intended, making misuse or unintended data access harder to prevent or audit.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 85% confidence
- Finding
This code initializes a crawler that will fetch remote URLs and also sets up local cache/output storage, but the file provides no confirmation prompt, user-facing log, or explanatory comment/docstring warning that network requests and file writes will occur. Because these operations can affect privacy and local data handling, they meet the missing-disclosure criteria for code files.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The runner periodically saves checkpoints and writes a final report to disk, but there is no prompt, print/log statement, or explanatory comment/docstring informing the user that files will be created or updated. These are direct file-write operations and should be disclosed when no other warning is present in the code.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The argument help strings and related user-facing text are written only in Turkish, which imposes a specific language on all users without opt-in or alternative locale support. This matches the policy category for language or locale constraints that are not documented as optional or justified.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
Both built-in presets set
no_robots: True, which causes the crawler to ignore robots.txt restrictions by default for common research modes. In a web-crawling skill, shipping bypass behavior as a preset increases the likelihood of unauthorized or policy-violating collection, and the deterministic/research framing does not justify disabling a standard access-control signal.- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The presets embed a robots.txt bypass capability for ordinary 'person-research' and 'deep-research' use cases without any narrow justification or safety guardrails. This makes misuse easier at scale, especially because these are ready-to-use defaults paired with relatively high page limits and concurrency.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The README contains the description "Scrapling tabanlı, browser'sız crawler." in Turkish, while the rest of the file is in English and there is no indication that the skill is intentionally region- or language-specific. This can violate a language/locale policy because it imposes a specific language on users without opt-in or justification.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
At L06-L07, the function writes checkpoint data to disk using
path.write_bytes(...), but there is no confirmation prompt, logging, print statement, or explanatory comment/docstring disclosing this file write. For a code file, file writes are in scope for missing-user-warning review when no visible disclosure is present in the file.- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The inline comment at L22 is written in Turkish while the rest of the file is in Python and adjacent comments are in English. This creates a language-specific constraint in natural-language content without offering choice or documenting a justified locale requirement.
- Content
Unpinned Dependencies
Low
- Category
- Supply Chain
- Confidence
- 95% confidence
- Finding
The dependency is specified with a lower-bound only, which allows future installs to resolve to different versions over time. This weakens build reproducibility and can unintentionally introduce vulnerable or breaking upstream releases through the software supply chain.
- Content
text selectolax>=0.3.21 tenacity>=8.2.3 orjson>=3.10.0 scrapling>=0.2.96
Unpinned Dependencies
Low
- Category
- Supply Chain
- Confidence
- 95% confidence
- Finding
Using an unpinned version range for this package permits non-deterministic dependency resolution across environments and over time. That increases supply-chain risk because a newly released compromised or vulnerable version could be installed without any change to this repository.
- Content
text selectolax>=0.3.21 tenacity>=8.2.3 orjson>=3.10.0 scrapling>=0.2.96
Unpinned Dependencies
Low
- Category
- Supply Chain
- Confidence
- 98% confidence
- Finding
The package is not pinned to an exact version, and the same file also shows this dependency has known advisories in some releases. Because installs may select any version at or above the minimum, affected versions could be pulled in, making this more dangerous than a generic reproducibility issue.
- Content
text selectolax>=0.3.21 tenacity>=8.2.3 orjson>=3.10.0 scrapling>=0.2.96
Unverifiable Dependency: orjson has 4 known advisory(ies) (CVE-2025-67221 (orjson does not limit recursion for deeply nested JSON documents); CVE-2024-27454 (orjson does not limit recursion for deeply nested JSON documents); CVE-2024-27454 (orjson.loads in orjson before 3.9.15 does not limit recursion for deeply nested ) +1 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected
Low
- Category
- Supply Chain
- Confidence
- 97% confidence
- Finding
The manifest does not pin orjson, and known advisories exist for some versions involving uncontrolled recursion on deeply nested JSON input. In a crawler-oriented skill that may process untrusted remote data, this can plausibly lead to denial of service through excessive recursion, crashes, or resource exhaustion if an affected version is installed.
- Content
Unpinned Dependencies
Low
- Category
- Supply Chain
- Confidence
- 95% confidence
- Finding
A lower-bounded but unpinned dependency introduces supply-chain and reproducibility risk by allowing different resolved versions on different installs. In a crawler skill that fetches and processes external content, unexpected dependency changes can affect parsing behavior and security posture.
- Content
text selectolax>=0.3.21 tenacity>=8.2.3 orjson>=3.10.0 scrapling>=0.2.96
Static analysis
No suspicious patterns detected.