Security audit

adaptive-web-analyzer

Security checks for vulnerabilities and agentic risk

Overview

The skill does what it claims at a high level, but it asks for powerful local permissions and fetches arbitrary URLs without enough scoping or user safeguards.

Install only if you are comfortable granting a web-analysis skill broad network fetching plus declared local write and command-execution permissions. Avoid using it on internal URLs, cloud metadata endpoints, authenticated admin pages, private APIs, or pages containing secrets unless the permissions are reduced and network/LLM safeguards are added.

A.I.G

Vulnerability Patterns

Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (3)

T05 · Unauthorized Access and Privilege Escalation

Error

Location: SKILL.md:5
Finding: Excessive File-Write and System-Execution Permissions
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: agent.py:72
Finding: Server-Side Request Forgery Through Unrestricted User-Controlled URLs
Content: View full analysis
str: """ 获取网页内容，支持多种策略 Args: url: 目标URL或API端点 method: 获取方式 (auto/api/static/dynamic) custom_headers: 自定义请求头 timeout: 超时时间 """ headers = {**self.session.headers, **(custom_headers or {})} # 判断是否为API端点 is_api = self._is_api_endpoint(url) if method == "auto": method = "api" if is_api else "static" # 1. API直接请求 if method == "api": return self._fetch_api(url, headers, timeout) # 2. 使用Scrapling（如果可用且需要反爬） if SCRAPLING_AVAILABLE and method in ["static", "stealth"]: return self._fetch_with_scrapling(url, stealth=(method == "stealth")) # 3. 使用Playwright（如果需要动态渲染） if PLAYWRIGHT_AVAILABLE and method == "dynamic": return self._fetch_with_playwright(url, timeout) # 4. 基础requests请求 return self._fetch_basic(url, headers, timeout) def _fetch_api(self, url: str, headers: Dict, timeout: int) -> str: """获取API响应""" resp = self.session.get(url, headers=headers, timeout=timeout) resp.raise_for_status() content_type = resp.headers.get('Content-Type', '') # 如果是JSON，格式化返回 if 'json' in content_type: try: data = resp.json() return json.dumps(data, ensure_ascii=False, indent=2) except: pass return resp.text def _fetch_basic(self, url: str, headers: Dict, timeout: int) -> str: """基础HTTP获取""" time.sleep(random.uniform(1, 3)) # 礼貌延迟 resp = self.session.get(url, headers=headers, timeout=timeout) resp.raise_for_status() ...[truncated 3105 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: agent.py:342
Finding: Indirect Prompt Injection Through Untrusted Webpage Content
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Behavioral ASTexec() Call, eval() Call, Dynamic Import

Findings (10)

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The skill requests system.exec even though its stated purpose is web fetching, scraping, parsing, and LLM summarization, none of which inherently require shell execution. This creates unnecessary remote-code-execution capability in a skill that processes attacker-controlled web content and user-supplied URLs, significantly increasing the blast radius if prompt injection, parser abuse, or future code paths invoke OS commands.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The skill requests file.write and system.exec without any user-facing explanation of why these powerful permissions are needed or what actions they may enable. In context, this is more dangerous because the skill ingests untrusted web content and supports custom headers, auth, proxies, and dynamic rendering, so hidden high-impact permissions undermine informed consent and increase abuse potential.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The skill explicitly sends fetched webpage or API content to an LLM for analysis without warning that scraped data may be transmitted to a third-party model provider. This can expose sensitive API responses, internal pages, tokens embedded in content, or personal data to external processing, especially because users may point the skill at arbitrary authenticated endpoints.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The code supports stealth anti-bot fetching via Scrapling and dynamic browser automation via Playwright, which materially expands collection capability beyond ordinary page retrieval. In a skill already granted web.fetch, web.scrape, llm.chat, file.write, and system.exec, these evasion-oriented features increase the risk of undisclosed scraping against protected targets and make misuse easier.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The skill fetches arbitrary webpage content and later packages extracted content and metadata into prompts for LLM analysis, but there is no disclosure, consent flow, or data-minimization control. This can expose sensitive page contents, embedded tokens, personal data, or proprietary material to downstream services without the user's clear awareness.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: Stealth scraping and browser-based rendering are performed without explicit notice to the user, which obscures the fact that the skill may impersonate browsers, execute complex page loads, and access content behind anti-bot controls. This increases legal, compliance, and privacy risk and can cause users to unknowingly trigger aggressive collection behavior.
Content: No source excerpt is available for this finding.

Lp4

Low

Category: MCP Least Privilege
Confidence: 65% confidence
Finding: Declared permissions with no matching code capability may indicate removed functionality or pre-staging for future abuse.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 84% confidence
Finding: The file's natural-language instructions and user-facing strings are exclusively in Chinese, including usage and analysis prompts, which effectively imposes a language choice. There is no indication that the user can select another language or that the locale restriction is documented as intentional and justified.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Low

Category: Not specified by scanner
Confidence: 72% confidence
Finding: The manifest's purpose is web fetching, parsing, and LLM-based summarization, but the file also supports standalone command-line execution. While not inherently malicious, local script execution is not an obvious requirement of the described end-user capability and helps justify the otherwise broad system.exec permission without clear purpose-level disclosure.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The config uses Chinese-only natural-language descriptions for optional dependencies, which imposes a specific language on users without any documented opt-in or alternative locale. This can violate language/locale policy expectations when the skill otherwise appears generally applicable rather than region-specific.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.