Security audit

Scrape Emails By URL

Security checks for vulnerabilities and agentic risk

Overview

This skill does what it says by crawling sites for emails, but it has broad outbound crawling and setup behavior that needs review before installation.

Review before installing. Use only in an isolated environment with restricted outbound network access, avoid internal or sensitive URLs, save outputs only to intended locations, and treat extracted emails as personal/contact data subject to site terms and applicable law. Prefer pinned dependencies or a locked environment before running the setup commands.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

Location: SKILL.md:20
Finding: Unpinned Executable Third-Party Dependencies
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/find_emails.py:26
Finding: Unrestricted Crawl Destinations Allow Server-Side Request Forgery
Content: View full analysis
str: """Add https:// if URL has no scheme. Returns URL unchanged if scheme present.""" parsed = urlparse(url) if parsed.scheme: return url if url.startswith("//"): return "https:" + url return "https://" + url ``` ```python async with AsyncWebCrawler(config=browser_config) as crawler: for url in urls: pages = await crawler.arun(url=url, config=crawler_config) items = pages if isinstance(pages, list) else [pages] all_pages.extend(items) ``` ```python elif args.urls: url_patterns = load_url_patterns(script_dir) urls = [ensure_scheme(u) for u in args.urls] try: email_sources = asyncio.run(crawl_and_extract( urls=urls, url_patterns=url_patterns, max_depth=args.max_depth, max_pages=args.max_pages, verbose=args.verbose, )) ``` ### Technical Analysis The command-line URL values are forwarded to a headless browser without validating the scheme or destination. `ensure_scheme()` accepts any input that already has a scheme instead of restricting inputs to HTTP and HTTPS. The implementation also does not reject loopback, private, link-local, multicast, reserved, or cloud metadata addresses. The crawler configuration uses `include_external=False`, but this limits links followed during deep crawling; it does not validate the initial destination. The code also does not show redirect-target validation or protection against DNS rebinding. Consequently, a URL that initially appears acceptable could resolve or redirect to an internal address after ...[truncated 2237 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (6)

Lp1

High

Category: MCP Least Privilege
Confidence: 95% confidence
Finding: The script performs outbound network crawling via crawl4ai against user-supplied URLs, which is a real network capability. If the skill manifest does not explicitly declare network access, this creates a permission mismatch that can bypass operator expectations and enable unintended requests to arbitrary hosts, including internal or sensitive endpoints if the runtime has such reachability.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The manifest description says to use the skill when 'extracting emails from websites, finding contact information, or crawling for email addresses.' Phrases like 'finding contact information' are broad and could match common user intents beyond this specific crawler, with no negative examples or explicit activation constraints.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The skill instructs users to crawl websites locally and allows writing outputs to disk, but provides no warning about privacy, legal considerations, or filesystem side effects. In this context, the omission is meaningful because the skill is specifically designed to collect contact data at scale and can persist that data locally without prompting users to consider consent, retention, or safe file handling.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: This manifest-style JSON defines wildcard URL patterns such as 'about', 'team', and 'support' without any narrowing context, exclusions, or scope constraints. These terms are common across many unrelated pages, so the activation surface is broad and could cause unintended skill invocation.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 83% confidence
Finding: The examples demonstrate saving results to local files but do not warn that files may be created or overwritten. This is a smaller issue than the broader privacy omission, but it can still lead to unintended local side effects or accidental exposure of extracted email data if users save to unsafe locations.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Low

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The documentation includes unrelated social media growth and paid follower promotion content in a skill whose purpose is crawling websites for email extraction. This kind of off-topic insertion is suspicious because it can manipulate downstream agent behavior, dilute trust boundaries, and normalize unrelated external services in a context that should stay narrowly scoped.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.