WebScraper

• Outcome: Pass
• Latest audit: Sep 12, 2026 · 8:21 AM UTC
• Version: 1.0.0

Overview

This is a straightforward web page extraction skill with some caution-worthy scraping and install guidance, but no hidden code, persistence, or deceptive behavior.

Installers should treat this as a basic web scraping helper: only fetch public URLs you intend to share with the agent, avoid localhost/private/cloud-metadata or secret-bearing links, respect site terms and robots.txt, and avoid the optional global npm install unless pinned and isolated in a project environment.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:73

Finding

Unpinned Global Installation of a Third-Party Dependency

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 73
Vulnerability Type: Unpinned global npm dependency installation
Risk Level: Medium

Vulnerable Code Snippet:

bash

npm install -g cheerio

Technical Analysis

The skill instructs users to install cheerio globally without specifying a reviewed version or using a lockfile. Consequently, npm resolves whichever package version and transitive dependencies are current at installation time. The audited content therefore does not fully determine the code that will be installed.

npm package installation can invoke package lifecycle scripts unless explicitly disabled. If the named package, one of its transitive dependencies, or the relevant registry delivery path becomes compromised, installation could execute attacker-controlled code with the privileges of the user running npm. The global -g option also changes the user's shared Node.js environment rather than isolating the dependency to this skill.

This is a supply-chain exposure rather than evidence that the current cheerio package is malicious.

Attack Path

1. An attacker compromises a future release of cheerio, one of its transitive dependencies, or the package distribution path.
2. A user follows the instruction in SKILL.md and runs npm install -g cheerio.
3. npm resolves and downloads the then-current, unpinned package graph.
4. Malicious package content or lifecycle behavior runs during installation or later when the installed module is used.
5. The payload operates under the privileges of the npm process and may affect the user's globally shared Node.js environment.

Impact Assessment

Successful exploitation could execute code with the privileges of the user performing the installation. Depending on those privileges, the payload could read or modify files accessible to that user, access environment variables and developer credentials, make network requests, or tamper ...[truncated 275 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin cheerio to a specifically reviewed version rather than resolving the latest release dynamically.
2. Declare it as a local project dependency instead of recommending global installation.
3. Generate and commit a lockfile so direct and transitive dependency versions are reproducible.
4. Use npm ci in a dedicated, least-privileged project directory for deterministic installation.
5. Where compatible with the package, disable lifecycle scripts during installation with --ignore-scripts.
6. Review package provenance, integrity metadata, maintainers, and transitive dependencies before updating the pinned version.
7. Run dependency auditing and update only after security review and testing.
8. Avoid executing npm installation commands with administrative or root privileges.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill encourages fetching arbitrary user-supplied URLs with web_fetch/curl but does not warn against localhost, link-local, cloud metadata, or other internal network targets. In an agent context, this can enable SSRF-style access, leak internal services or sensitive metadata, and expose user-provided URLs to third-party infrastructure without clear privacy guidance.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The guidance explicitly suggests using a browser-like User-Agent to 'avoid bot detection,' which can facilitate bypassing site access controls or operator intent. In a scraping skill, this increases the likelihood of policy-violating use and can expose users or operators to legal, compliance, or account/IP blocking consequences.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.