Agent Ready Scanner

• Outcome: Review
• Latest audit: Sep 16, 2026 · 6:53 AM UTC
• Version: 1.0.0

Overview

The skill mostly does what it claims, but unsafe URL handling and unescaped HTML reports create real review-worthy security risks.

Review before installing. Use this only for authorized public websites, preferably in an environment with egress controls that block localhost, private networks, and cloud metadata endpoints. Treat generated HTML reports as untrusted until the report generator escapes all dynamic fields.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/scan.py:43

Finding

Unrestricted URL Fetching Enables Server-Side Request Forgery

Content

View full analysis

Optional[requests.Response]: """安全的 HTTP GET 请求""" try: resp = self.session.get(url, timeout=self.timeout, allow_redirects=True, **kwargs) return resp except RequestException: return None def safe_head(self, url: str) -> Optional[requests.Response]: """安全的 HTTP HEAD 请求""" try: resp = self.session.head(url, timeout=self.timeout, allow_redirects=True) return resp except RequestException: return None ``` The sitemap check also follows URLs supplied by the scanned server: ```python def check_sitemap(self) -> CheckResult: """检查 sitemap.xml 是否存在""" # 先尝试从 robots.txt 获取 sitemap URL robots_resp = self.safe_get(f"{self.base_url}/robots.txt") sitemap_urls = [] if robots_resp and robots_resp.status_code == 200: for line in robots_resp.text.splitlines(): if line.lower().startswith('sitemap:'): sitemap_urls.append(line.split(':', 1)[1].strip()) if not sitemap_urls: sitemap_urls = [f"{self.base_url}/sitemap.xml"] for url in sitemap_urls: resp = self.safe_get(url) ``` ### Technical Analysis The scanner accepts a user-controlled target and performs numerous requests without validating the destination hostname or resolved IP addre ...[truncated 2453 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/generate_html.py:44

Finding

Unescaped Report Data Enables Stored HTML and JavaScript Injection

Content

View full analysis

{icon} {check['name']}

{check['message']}

''' if has_details: check_html += f'''

text

{details_json}

''' if fix_suggestion: check_id = f"{cat_name}-{check['name']}-{i}".replace(' ', '-').lower() check_html += f'''

💡 修复建议

text

{fix_suggestion}

📋 复制

''' check_html += '\n ' checks_html.append(check_html) cat_html = f'''

{cat_name}

{cat_data['score']}/{cat_data['max_score']}

{''.join(checks_html)}

''' categories_html.append(cat_html) # 替换模板变量 html = template html = html.replace('{{url}}', report_json['url']) html = html.replace('{{timestamp}}', report_json['timestamp']) html = html.replace('{{total_score}}', str(total)) html = html.replace('{{max_score}}', str(max_score)) html = html.replace('{{percentage}}', str(percentage)) html = html.replace('{{dash_offset}}', str(dash_offset)) html = html.replace('{{score_color}}', score_color) html = html.replace('{{summary}}', report_json['summary']) ``` ### Technical Analysis The report generator int ...[truncated 2642 chars]

Remediation

View remediation

`. 5. Generate element IDs from a strict allowlist such as `[A-Za-z0-9_-]` rather than embedding report values directly. 6. Avoid inline event handlers such as `onclick`. Register event listeners from a static script instead. 7. Validate input JSON against a strict schema, including expected types, status values, numeric ranges, and maximum string lengths. 8. Add a restrictive Content Security Policy, for example one that disallows inline scripts and limits network destinations. 9. Consider rendering untrusted details with `textContent` through DOM APIs rather than constructing markup through string concatenation. 10. Add regression tests containing payloads in URLs, category names, messages, details, remote headers, metadata names, suggestions, and IDs. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (12)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence

Finding

整体主功能与描述高度一致：代码接收网站 URL，发起 HTTP/HEAD 请求检查网站是否对 AI Agent 友好，包含 robots.txt、llms.txt、MCP、Agent Skills 等项目，并计算评分与给出修复建议。未发现与该目的无关的敏感或额外能力，也没有异常资源访问，主要访问的都是目标站点上的公开路径。唯一明显不一致之处在于输出形式：声明写的是“生成 HTML 报告”，而代码只实现了 JSON 和 text 两种格式，没有 HTML 生成功能。因此应判定为存在描述与行为不匹配，但属于较小的功能性偏差，而非主目的偏离。

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The skill advertises activation via broad, natural-language phrases such as scanning any domain for 'agent readiness' without clear scope limits, confirmation requirements, or exclusions. In an agent ecosystem, this can cause overbroad or unintended invocation and trigger network scanning of attacker-supplied targets, which is risky because the skill performs real HTTP requests rather than static analysis.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · README_zh.md (reported line 211)May include surrounding context.

"description": "提供示例网站的 MCP 接口", "transport": { "type": "sse", "url": "https://api.example.com/mcp/sse" } }

text

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 97% confidence

Finding

The skill instructs the agent to perform network access and write output files, but it does not declare any explicit tool scope such as allowed-tools or permissions. This creates an authorization and transparency gap: an agent runtime may permit broader-than-expected capabilities, and users are not clearly informed that the skill will access remote hosts and write files locally.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

This template sets the document language to zh-CN and the rendered interface also contains Chinese-only labels such as 分, 修复建议, 复制, 已复制, and 参考. That forces a specific language/locale in the skill output without any opt-in or documented region-specific justification, which matches the natural-language policy violation criteria.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

This code file contains natural-language descriptions entirely in Chinese, including the module docstring and user-facing messaging, with no indication that users can choose another language. That creates a locale-policy concern because the skill appears to impose a specific language without user opt-in or a documented region-specific justification.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The manifest describes a skill that scans whether a website is ready for AI agents by checking items like robots.txt, llms.txt, MCP, and Agent Skills. The code additionally scores support for x402, UCP, and ACP commerce/payment protocols, which are not mentioned in the manifest description and materially broaden the notion of 'agent readiness' into agentic commerce capability assessment.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The manifest says the skill outputs an HTML report with scores, status, and remediation advice. In code, the CLI only supports JSON or plain text output and writes exactly that to the output file, with no HTML generation path present.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

All user-facing guidance in this file is presented in Chinese, and the document does not indicate that the language choice is optional or region-specific. Per the policy, forcing a specific language without user opt-in can be a locale-policy issue.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The skill description does not warn users that scanning a site will generate outbound network requests to the target website. This is a real safety issue because users may unknowingly trigger traffic to third-party systems, which can have privacy, compliance, or operational consequences in sensitive environments.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The skill says it will save an HTML report to a user-specified location or the current working directory, but it does not clearly warn that local files will be created. This can lead to unintended writes, disclosure of scan results on shared systems, or overwriting/confusion in the working directory if users are not prompted to approve the output path.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

This Python file contains user-facing and descriptive natural-language text only in Chinese, including the module docstring, function docstring, argparse descriptions, and status output. Under the stated policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale constraint is documented and justified, which is not present here.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.