documentation-writer

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 7:26 AM UTC
• Version: 1.0.0

Overview

This documentation-writing skill is coherent and purpose-aligned, with only cautionary notes about example code that writes files and validates links.

Before reusing the examples, choose a safe output directory and restrict or disable external link checks if the generator will process untrusted documentation or run inside a private network.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: references/examples.md:607

Finding

Server-Side Request Forgery Through Unrestricted Link Validation

Content

View full analysis

Vulnerability Details

File Location: references/examples.md, lines 607-623
Vulnerability Type: Server-Side Request Forgery (SSRF)
Risk Level: Medium

Vulnerable Code

typescript

private async validateLink(link: string): Promise<boolean> {
  if (link.startsWith('http')) {
    // Check external link
    try {
      const response = await fetch(link, { method: 'HEAD' });
      return response.ok;
    } catch {
      return false;
    }
  } else {
    // Check local file
    try {
      await fs.access(path.join(this.config.projectPath, link));
      return true;
    } catch {
      return false;
    }
  }
}

Technical Analysis

The documentation generator extracts links from project-controlled content and sends a server-side HEAD request to any string beginning with http. It does not parse and validate the URL, restrict destinations, resolve and inspect host addresses, block internal network ranges, constrain redirects, or apply an explicit timeout.

An attacker able to introduce a Markdown link into analyzed documentation could therefore cause an implementation based on this example to request attacker-selected network destinations. Potential targets include loopback services, private-network hosts, link-local addresses, and cloud metadata services. DNS rebinding and redirects may also bypass simplistic hostname checks unless every resolved address and redirect destination is validated.

Although HEAD requests may reduce response-body exposure, they still permit network reachability probing and can trigger state-changing behavior in services that incorrectly process HEAD. This issue is present in reference example code rather than an automatically executed packaged script.

Attack Path

1. The attacker gains the ability to add or modify documentation content analyzed by the generator.
2. The attacker inserts a Markdown link targeting an internal resource, such as http://127.0.0.1:PORT/path or a private-network service ...[truncated 1114 chars]

Remediation

View remediation

Remediation Suggestions

1. Parse each candidate with the standard URL API and allow only explicitly required schemes, preferably HTTPS.
2. Use an allowlist of approved hostnames where external link checking does not require unrestricted Internet access.
3. Resolve the hostname before connecting and reject every address in loopback, private, link-local, multicast, reserved, and cloud-metadata ranges for both IPv4 and IPv6.
4. Revalidate the resolved address immediately before connection to mitigate DNS rebinding.
5. Disable automatic redirects or validate every redirect destination using the same scheme, hostname, and IP-address rules.
6. Apply strict connection and total-request timeouts, response-size limits, concurrency limits, and request-rate limits.
7. Run link validation in a sandbox with outbound firewall rules that deny access to internal networks and metadata services.
8. Avoid exposing detailed network errors or status differences to untrusted users.
9. Consider making external link validation opt-in or delegating it to a restricted CI service.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (3)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

This markdown file embeds code that creates directories and writes multiple documentation files to the configured output path. The surrounding markdown provides no user-facing warning that running the example will modify the local filesystem, which is a safety-relevant behavior for markdown content under this rule.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The embedded example issues HEAD requests to external URLs when validating links via fetch(). The markdown does not disclose that executing the example may contact external hosts and transmit request metadata, so users are not warned about the network behavior.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 80% confidence

Finding

The example emits HTML with lang="en", which forces an English locale in generated output. There is no indication that this locale is configurable, optional, or justified as region-specific, so it conflicts with the language/locale policy described for all file types.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.