T09 · Insecure Skill Coding Practices
Error
- Location
scripts/ddg_fetch.py:65- Finding
Unrestricted URL Fetching Enables Server-Side Request Forgery
- Content
View full analysis
- Remediation
View remediation
Security audit
DuckDuckGo Search
Security checks for vulnerabilities and agentic risk
Overview
The skill mostly does what it says, but its page fetcher can request arbitrary destinations without internal-network or size safeguards.
Review this skill before installing in any environment with access to private networks, localhost services, cloud metadata endpoints, or sensitive internal web apps. If used, run it with outbound network restrictions, avoid fetching untrusted or internal URLs, and remove or pin the unused pip dependency guidance.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/ddg_fetch.py:101- Finding
Unbounded Response Reading and Decompression Enables Memory Exhaustion
- Content
View full analysis
- Remediation
View remediation
T08 · Insecure Dependencies
Note
- Location
SKILL.md:14- Finding
Unpinned and Unnecessary Third-Party Dependency Installation
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Behavioral ASTexec() Call, eval() Call, Dynamic Import
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (8)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The skill promises arbitrary URL fetching and readable content extraction, but that functionality is not evidenced by the provided artifacts. A skill that claims unverified remote-fetch behavior can mislead operators into enabling network-sensitive workflows and weakens trust boundaries around what data may be retrieved or processed.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
The skill promises arbitrary URL fetching and readable content extraction, but that functionality is not evidenced by the provided artifacts. A skill that claims unverified remote-fetch behavior can mislead operators into enabling network-sensitive workflows and weakens trust boundaries around what data may be retrieved or processed.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 92% confidence
- Finding
The skill advertises and demonstrates shell execution and network access but does not declare any tool scope such as permissions or allowed-tools. In an agent environment, missing scope declarations can cause the skill to run with broader-than-necessary privileges, increasing the chance of unintended command execution or outbound access if invoked automatically.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
Broad trigger phrases like 'search for', 'look up', and 'fetch url' can cause this skill to activate in many benign conversations, including contexts where the user did not intend network access. In an agent system, over-triggering increases the risk of unsolicited web requests, data exposure in queries, and execution of shell-backed workflows without sufficiently explicit user intent.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
Spawning an external curl process gives the skill unnecessary process-execution capability for a feature that can already be implemented with the standard library. While this code does not obviously permit command injection, adding subprocess execution broadens the attack surface, increases environmental dependency risk, and may bypass controls or monitoring that apply only to in-process HTTP requests.
- Content
subprocess module call
Medium
- Category
- Dangerous Code Execution
- Confidence
- 70% confidence
- Finding
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
- Content
python url ] result = subprocess.run(cmd, capture_output=True, text=True, timeout=25) html = result.stdout if result.returncode != 0:
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The document switches from English to Chinese for key usage sections such as prerequisites and feature headings, which imposes a language choice without opt-in. This can violate language/locale policy expectations when the skill does not state that it is intended specifically for Chinese-speaking users or offer alternatives.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The request hard-codes an Accept-Language header of 'en-US,en;q=0.9,zh-CN;q=0.8,zh;q=0.7', which imposes locale preferences regardless of the user's actual language choice. This matches the policy category for language or locale constraints that are not user-selectable or clearly justified.
- Content
Static analysis
No suspicious patterns detected.