crawl requirement from confluence

• Outcome: Review
• Latest audit: Sep 12, 2026 · 2:34 AM UTC
• Version: 1.0.1

Overview

This Confluence export skill matches its stated purpose, but it asks for raw session cookies and can automatically delete or package broader workspace data than users may expect.

Install only if you are comfortable with an agent exporting all reachable Confluence child pages and images. Do not paste raw browser cookies into chat; prefer a scoped read-only token or a protected browser/session integration. Review and change the cleanup and ZIP steps so they only touch the current export directory, and use local pinned conversion tools instead of global installs or online converters for private documents.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:360
• Finding: Exposure and Insecure Handling of Reusable Confluence Session Cookies<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:360-438` **Vulnerability Type**: Plaintext authentication-secret handling **Risk Level**: High ### Vulnerable Code ```powershell $cookie = "JSESSIONID=xxx; CONFLAuth=xxx" $imagesDir = "$outputDir\images" $maxRetries = 3 $result = curl.exe -L -o $outputFile $imageUrl ` -H "Cookie: $cookie" ` -H "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36" ` --silent --show-error ` 2>&1 ``` The surrounding instructions direct the user to copy a complete browser cookie string, including `JSESSIONID`, `CONFLAuth`, and potentially other cookies, and provide it to the agent. ### Technical Analysis The skill handles reusable Confluence session credentials as plaintext input and then embeds them directly in PowerShell variables and `curl.exe` command-line arguments. This exposes the credentials to multiple unnecessary surfaces: - Conversation or agent execution history - Debugging and diagnostic logs - Shell transcripts and command history - Process command-line inspection - Child sessions created by the agent - Accidental inclusion in generated artifacts or error reports A complete session cookie may provide access equivalent to the authenticated user. Requesting all browser cookies also violates least-privilege principles because unrelated analytics, routing, or authentication cookies may be disclosed even when they are not necessary for the export. The use of HTTPS protects cookies while they are transmitted to Confluence, but it does not mitigate local plaintext exposure or disclosure through the agent context. ### Attack Path 1. A user signs in to a private Confluence deployment. 2. The skill instructs the user to copy reusable authentication cookies from browser storage. 3. The user submits the complete cookie string to the agent. 4. The agent places the cookie in a plaintext variable and supplies it as a command-line header to `curl.exe`. 5. A party with acce ...[truncated 955 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Do not ask users to paste complete browser cookie strings into the conversation. 2. Use an approved browser-session integration or operating-system secret store that does not expose raw credentials to the model. 3. Prefer a narrowly scoped Confluence API token or OAuth token with read-only access to the required space and pages. 4. Pass secrets through a protected mechanism such as an inherited file descriptor or restricted temporary configuration file rather than command-line arguments. 5. Restrict every authenticated request to the validated Confluence origin. Reject redirects to a different host before forwarding credentials. 6. Never send cookies to child sessions, generated documents, logs, status messages, or error output. 7. Redact `Cookie`, `Authorization`, `JSESSIONID`, and `CONFLAuth` values in all telemetry. 8. Clear secret variables immediately after the authenticated operation and ensure temporary secret material is securely removed. 9. Document credential revocation and session-expiration procedures for accidental disclosure. ]]>

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:330
• Finding: Unpinned Runtime Installation of Third-Party Conversion Packages<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:330-342` **Vulnerability Type**: Uncontrolled third-party dependency installation **Risk Level**: Medium ### Vulnerable Code ```powershell python -m pip install markdownify python -c "from markdownify import markdownify; print(markdownify(html_content))" ``` ```powershell npm install -g turndown echo $htmlContent | turndown ``` The skill also identifies an external online HTML-to-Markdown service as another conversion option. ### Technical Analysis The instructions install packages at execution time without exact version pins, integrity hashes, a lockfile, registry restrictions, or provenance verification. Consequently, the code that is installed can change after the skill itself has been reviewed. The global npm installation is especially broad because it modifies the user or system-level package environment rather than an isolated task environment. Depending on local npm configuration and account privileges, package lifecycle scripts may execute with the privileges of the agent process. The proposed online conversion alternative creates a separate confidentiality concern. If used with internal Confluence HTML, it could send proprietary requirements and embedded document content to a third-party service. The document does not include a concrete upload command, so this is a documented unsafe option rather than confirmed exfiltration. ### Attack Path 1. The agent follows one of the runtime package-installation instructions. 2. The package manager resolves the current package release and its transitive dependencies from the configured registry. 3. A compromised release, registry account, transitive dependency, or package source supplies malicious installation or runtime code. 4. Package lifecycle hooks or imported conversion code execute under the agent process. 5. The malicious code reads files, environment variables, exported Confluence content, or credentials accessible to that process ...[truncated 955 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Pre-audit and package the required converter with the skill rather than installing it during execution. 2. Pin every direct and transitive dependency to an exact version. 3. Verify packages using hashes, signed provenance, or a trusted internal artifact repository. 4. Use lockfiles and reproducible builds. 5. Install dependencies into an isolated virtual environment or disposable container; do not use global npm installation. 6. Disable package lifecycle scripts where practical and required functionality permits it. 7. Run conversion with minimal filesystem and network permissions. 8. Perform HTML-to-Markdown conversion locally for private Confluence content. 9. Remove the external online conversion recommendation unless the service has been formally approved for the data classification involved. 10. If external processing is unavoidable, require explicit informed user approval, contractual data-handling controls, content minimization, and an allowlisted endpoint. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:78
• Finding: Automatic Destructive Cleanup Can Delete Unrelated Workspace Artifacts<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:78-117` **Vulnerability Type**: Overly broad and unconfirmed recursive deletion **Risk Level**: High ### Vulnerable Code ```powershell $zipFiles = Get-ChildItem $workspaceDir -Filter "*.zip" -ErrorAction SilentlyContinue $zipFilesSorted = $zipFiles | Sort-Object LastWriteTime foreach ($zip in $zipFilesSorted) { if ($totalSize -lt ($maxSize * $warnThreshold)) { break } $z = $zip.Length Remove-Item $zip.FullName -Force $totalSize -= $z } $dirs = Get-ChildItem $outputDir -Directory -ErrorAction SilentlyContinue | Sort-Object LastWriteTime foreach ($dir in $dirs) { if ($totalSize -lt ($maxSize * $warnThreshold)) { break } $dirSize = ( Get-ChildItem $dir.FullName -Recurse -ErrorAction SilentlyContinue | Measure-Object -Property Length -Sum ).Sum if ($dirSize -gt 0) { Remove-Item $dir.FullName -Recurse -Force $totalSize -= $dirSize } } ``` A substantially duplicated cleanup block also appears at `SKILL.md:256-295`. ### Technical Analysis When calculated storage exceeds 80% of the configured one-gigabyte limit, the skill automatically removes files without requesting confirmation or proving that the files belong to the current skill. The ZIP-file selection searches the workspace root for every file matching `*.zip`. It does not check a skill-specific filename prefix, ownership manifest, task identifier, or dedicated export directory. Therefore, archives produced by users or other skills can be deleted. The output cleanup similarly removes entire directories recursively and forcibly based only on modification time. It does not verify directory ownership or preserve recoverability. The deletion also occurs at the warning threshold rather than safely stopping the current export. Because the paths are configuration variables, an incorrect or modified `$workspaceDir` or `$outputDir` increases the potential deletion scope. ### ...[truncated 1338 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Store all skill artifacts under a dedicated, canonicalized directory that is not shared with other tasks. 2. Create an ownership manifest for each export and delete only paths explicitly listed in that manifest. 3. Validate canonical paths before deletion and reject paths outside the dedicated skill directory. 4. Replace automatic deletion with a safe failure when the quota is exceeded. 5. Require explicit user confirmation after displaying the exact paths and sizes proposed for deletion. 6. Provide a dry-run mode and make it the default. 7. Move files to a recoverable trash or quarantine location instead of using immediate forced deletion. 8. Use a skill-specific archive filename pattern and task identifier rather than matching every `*.zip`. 9. Protect active exports, pinned artifacts, and directories without a valid skill ownership marker. 10. Add tests covering malformed paths, symbolic links or reparse points, empty directories, concurrent exports, and unrelated workspace files. 11. Remove or consolidate the duplicated cleanup implementation so that security fixes apply consistently. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (7)

Missing User Warnings

High

• Confidence: 97% confidence
• Finding: The skill mandates automatic deletion of old directories and ZIP files once storage thresholds are reached, without explicit user confirmation or safeguards. This can destroy prior exports or unrelated workspace artifacts, resulting in irreversible data loss and possible deletion of records the user expected to retain.

Context-Inappropriate Capability

High

• Confidence: 99% confidence
• Finding: The skill explicitly instructs the user to reveal raw authenticated Confluence session cookies and then reuse them directly for requests. Session cookies are bearer credentials; exposing them to the model or logs can enable account/session hijacking and unauthorized access to private Confluence content far beyond the intended page export.

Missing User Warnings

High

• Confidence: 99% confidence
• Finding: The skill asks the user to provide a full authentication cookie string without a strong warning that this is highly sensitive credential material. Requesting bearer credentials in conversational input creates a substantial risk of credential exposure via prompt history, logs, telemetry, or accidental reuse.

Ssd 3

High

• Confidence: 98% confidence
• Finding: The skill directs the agent to obtain and use the user's authenticated Confluence cookie string to fetch private content and then package the collected material. In context, this is dangerous because it combines credential handling with bulk extraction of potentially sensitive internal documentation, increasing the blast radius if the workflow is abused or compromised.

Ssd 3

Medium

• Confidence: 74% confidence
• Finding: The instructions emphasize copying all source material without omission, including potentially sensitive annotations and details, and later packaging everything into a zip. This creates a natural-language data-leak risk because it normalizes indiscriminate collection and redistribution of all visible information rather than minimizing or filtering sensitive content.

Context-Inappropriate Capability

Medium

• Confidence: 90% confidence
• Finding: The skill recommends installing third-party Python/Node packages and even sending content to an online HTML-to-Markdown API. This expands the trust boundary and can leak sensitive Confluence data to external services or introduce supply-chain risk from unpinned packages and global installs.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The packaging step archives the entire output root rather than only the directory created for the current run. That can unintentionally include prior exports, unrelated artifacts, or other users' data, causing cross-run data leakage when the ZIP is delivered.

Static analysis

No suspicious patterns detected.