T09 · Insecure Skill Coding Practices
Error
- Location
scripts/fetch.py:13- Finding
HTTPS Certificate and Hostname Verification Disabled Globally
- Content
View full analysis
- Remediation
View remediation
Security audit
Smart Web Fetch
Security checks for vulnerabilities and agentic risk
Overview
The skill is a real webpage-fetching helper, but it sends requested URLs to third-party services and fetches arbitrary URLs with weakened HTTPS checks, so it needs Review before installation.
Install only if you intend to use it for public webpages and are comfortable sending target URLs to the named third-party cleaning services. Do not use it for private intranet pages, signed links, URLs containing tokens, or sensitive documents unless the code is changed to validate destinations, preserve HTTPS verification, and require explicit consent for third-party forwarding.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (3)
T09 · Insecure Skill Coding Practices
Error
- Location
scripts/fetch.py:61- Finding
Unrestricted URL Fetching Permits Server-Side Requests to Internal Services
- Content
View full analysis
dict: """获取 URL 内容""" req = urllib.request.Request( url, headers={ 'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.0' } ) with urllib.request.urlopen(req, timeout=timeout, context=ssl_context) as response: content = response.read().decode('utf-8', errors='ignore') ``` ```python # scripts/fetch.py:99-107 def main(): if len(sys.argv) < 2: print("Usage: fetch.py [--json]", file=sys.stderr) print(" --json Output as JSON", file=sys.stderr) sys.exit(1) url = sys.argv[1] output_json = "--json" in sys.argv result = get_clean_content(url) ``` ### Technical Analysis The command-line argument is passed into the fetch pipeline without validating its scheme, hostname, resolved address, destination port, or redirects. When the external cleaning services do not return acceptable content, the script directly requests the original URL from the machine running the Agent. This creates an SSRF-style primitive: a party able to influence the requested URL can cause the Agent host to issue network requests using its own network position. The host may be able to reach localhost interfaces, private network services, container control endpoints, or cloud instance metadata services that are inaccessible to the external user. The code also does not validate redirect destinations. Even if initial-host validation were later added, an allowed public endpoint could redirect the request ...[truncated 1731 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/fetch.py:34- Finding
Sensitive URL Data Is Forwarded to Multiple Third-Party Services
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (9)
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 93% confidence
- Finding
The skill clearly directs the agent to invoke a Python script that performs outbound web requests, but the manifest declares no explicit tool scope or permissions. This weakens governance and reviewability because consumers cannot tell from the skill declaration that network access and third-party transmission are required, increasing the chance of unintended data egress or unsafe deployment.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The skill routes requested URLs through third-party cleaning services such as r.jina.ai, markdown.new, and defuddle.md, but the description does not warn users that requested pages and possibly sensitive query strings will be sent to external services. This creates a real privacy and confidentiality risk, especially if the agent is asked to fetch private, signed, internal, or user-specific links.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
The manifest description is written to present the skill in Chinese and specifically highlights Chinese support, but there is no indication that language or locale is user-selectable or region-specific by design. Under the policy, forcing or assuming a specific language without opt-in can be a locale-policy violation.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The tool forwards user-supplied URLs to external services (r.jina.ai, markdown.new, defuddle.md) before attempting a direct fetch, which exposes the user's target URL and potentially sensitive query parameters to third parties without explicit disclosure or consent. In an agent context, users may provide private intranet links, presigned URLs, or token-bearing URLs, so this behavior can leak sensitive metadata or access tokens outside the intended trust boundary.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The script explicitly disables both TLS certificate validation and hostname verification for outbound HTTPS probes. This makes the service-availability checks vulnerable to man-in-the-middle interception or spoofing, allowing an attacker on the network path to influence which fallback URL is selected or to conceal failures of the real service.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The code sends the user-supplied target URL to external services such as r.jina.ai, markdown.new, and defuddle.md during probing and final transformation, without any warning or consent mechanism. This can leak sensitive internal, private, or token-bearing URLs to third parties, which is especially risky in an agent skill intended to fetch arbitrary user-requested web content.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
The natural-language description and inline documentation are exclusively in Chinese, with no indication that users can choose another language. Under the stated policy, forcing a specific language without opt-in is a natural-language policy concern.
- Content
Intent-Code Divergence
Low
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The file is described as a URL preprocessor, but it also performs live outbound network checks to third-party services. That mismatch matters because operators and upstream agents may treat it as a pure transformation utility and unknowingly grant or invoke network-capable behavior, reducing transparency and informed consent.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 78% confidence
- Finding
The file's human-readable docstrings and comments are written in Chinese only, including the skill description and operational notes, without offering an alternate language or indicating that Chinese is required for a region-specific reason. This can violate language/locale policy where user-facing skill content should not force a specific language without opt-in.
- Content
Static analysis
No suspicious patterns detected.