HTML Text Extract

• Outcome: Review
• Latest audit: May 28, 2026 · 7:55 AM UTC
• Version: 1.0.0

Overview

This skill appears to extract HTML as advertised, but it can also install an unpinned Python package into the host environment when run.

Review before installing. Use this only in a virtual environment or container, or preinstall a reviewed and pinned trafilatura version yourself. The main extraction behavior is coherent, but the automatic pip install with a system-package override is under-disclosed and can alter your Python environment.

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (6)

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

return
    warn(f"Installing missing packages: {', '.join(missing)}...")
    try:
        subprocess.check_call(
            [sys.executable, "-m", "pip", "install", *missing, "--break-system-packages"]
        )
    except subprocess.CalledProcessError:

• Confidence: 96% confidence
• Finding: This subprocess call invokes pip to install packages at runtime, which mutates the host environment and executes code from externally retrieved packages. Although the command is not shell-injected, automatic installation of dependencies without explicit user approval creates supply-chain and environment-integrity risk, especially in agent or automation contexts.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

except subprocess.CalledProcessError:
        # --break-system-packages may not be supported (e.g. macOS, older pip). Retry without it.
        try:
            subprocess.check_call(
                [sys.executable, "-m", "pip", "install", *missing]
            )
        except subprocess.CalledProcessError:

• Confidence: 96% confidence
• Finding: This fallback subprocess call repeats the same unsafe pattern by attempting pip installation automatically if the first command fails. The issue is not command injection but unprompted execution of package installation logic, which can alter system state and introduce malicious or compromised dependencies into the environment.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 90% confidence
• Finding: The skill documentation describes invoking a Python script that can fetch remote URLs and execute shell command pipelines, but the skill metadata declares no corresponding permissions. This mismatch is a real security issue because it hides network and shell-capable behavior from any policy or review layer that relies on declared permissions, reducing transparency and potentially allowing unintended data egress or command chaining.

Context-Inappropriate Capability

Medium

• Confidence: 99% confidence
• Finding: For a skill whose stated purpose is simple HTML content extraction, runtime pip installation is unnecessary privileged behavior that expands the attack surface beyond the declared function. In an agent setting, this is more dangerous because a benign-looking text-processing tool can unexpectedly download and execute third-party package code on the host.

Description-Behavior Mismatch

Medium

• Confidence: 98% confidence
• Finding: The manifest describes passive extraction from URL, file, or stdin, but the implementation also changes the host by installing packages. This mismatch is security-relevant because users and orchestrators may grant the skill more trust than warranted, and hidden environment mutation is particularly risky in shared, production, or sandboxed systems.

Missing User Warnings

Medium

• Confidence: 99% confidence
• Finding: Automatic package installation without confirmation is a genuine security issue because it causes network access, code retrieval, and code execution from package indexes without explicit operator approval. The skill context makes this more dangerous, not less, because HTML extraction does not inherently require modifying the environment, so this behavior is unexpected and violates least surprise and least privilege.

Static analysis

No suspicious patterns detected.