Security audit

PLS Website Audit

Security checks for vulnerabilities and agentic risk

Overview

This website-audit skill is a straightforward checklist and command guide, with some normal but notable package and network-safety risks to manage.

Installers should understand that this skill is a guide for running website-audit commands. Before executing its examples, prefer pinned package versions or a locked dependency environment, run audits from a low-privilege sandbox, and only audit domains you are authorized to test. Do not expose the Python URL-fetching snippets directly to untrusted users without allowlists, redirect validation, private-network blocking, and timeouts.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

Location: SKILL.md:29
Finding: Unpinned Third-Party Packages Are Downloaded and Executed
Content: View full analysis
Remediation: View remediation
https://example.com --only-categories=performance --output=json python -m pip install LinkChecker== ``` 2. Install reviewed Node.js dependencies through a committed lockfile and use: ```bash npm ci npx --no-install lighthouse https://example.com ``` 3. Use Python requirements files with exact versions and cryptographic hashes: ```bash python -m pip install --require-hashes -r requirements.txt ``` 4. Verify package names, publishers, release signatures where available, and expected integrity hashes before use. 5. Run website-audit tools in a sandbox or disposable container with minimal filesystem access, no unnecessary credentials, and restricted outbound networking. 6. Establish a controlled dependency-update process that reviews and tests new versions before changing the pinned versions. ]]>

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.md:34
Finding: Arbitrary URL Fetching Can Reach Internal or Privileged Network Services
Content: View full analysis
max_depth or url in visited: return visited.add(url) try: response = requests.get(url, timeout=10) if response.status_code >= 400: broken.append({'url': url, 'status': response.status_code}) return soup = BeautifulSoup(response.text, 'html.parser') for link in soup.find_all('a', href=True): href = urljoin(url, link['href']) if urlparse(href).netloc == urlparse(base_url).netloc: check_page(href, depth + 1) except Exception as e: broken.append({'url': url, 'error': str(e)}) check_page(base_url, 0) return broken ``` The security-header audit also sends a request to an unrestricted URL: ```python import requests def audit_security_headers(url): response = requests.head(url) headers = response.headers ``` ### Technical Analysis These examples accept a URL without validating its scheme, resolved IP address, destination port, redirect chain, or relationship to an explicitly approved public target. If these functions are incorporated into an Agent, API, or service that accepts untrusted target URLs, they create a server-side request forgery-like ...[truncated 2529 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (6)

Rp1

Medium

Category: MCP Rug Pull
Confidence: 95% confidence
Finding: The skill instructs users to run npx lighthouse without pinning a specific package version. npx may fetch the latest package from the registry at execution time, creating a supply-chain risk where a compromised upstream release or typosquatted package could execute arbitrary code on the user's system.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 95% confidence
Finding: The unpinned npx web-vitals command causes dynamic resolution of whatever package version is current when the command is run. This exposes users to arbitrary code execution if the package publisher account, dependency chain, or package name is compromised.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 95% confidence
Finding: Running npx axe-cli without a pinned version allows retrieval and execution of the latest package at runtime. In a skill meant for website audits, this is especially relevant because users may copy-paste commands directly, increasing the chance of silent exposure to npm supply-chain compromise.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 96% confidence
Finding: The command npx pa11y is unpinned and therefore may download and execute whatever version npm currently serves. Because npx executes package lifecycle code and binaries, a malicious or compromised release could lead to local code execution during an otherwise routine audit.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 96% confidence
Finding: This reference again recommends npx pa11y without version pinning in the quick reference section, reinforcing unsafe copy-paste behavior. Repetition increases practical risk because users are more likely to treat the command as approved standard practice and execute unverified remote code.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 95% confidence
Finding: The quick reference includes npx lighthouse without version pinning, which carries the same runtime package resolution and supply-chain execution risk as elsewhere in the file. Given the command appears in a summary table, it is likely to be copied directly, making exploitation more plausible if the package ecosystem is compromised.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.