T08 · Insecure Dependencies
Error
- Location
SKILL.md:89- Finding
Unverified Third-Party Executable Dependency
- Content
View full analysis
- Remediation
View remediation
Security audit
audit website for SEO, security, performance and 200+ other issues
Security checks for vulnerabilities and agentic risk
Overview
The skill appears to be a legitimate website auditing workflow, but it needs review because it runs an unverified external CLI, encourages live crawling, can edit local projects, and documents piping website-derived reports directly into an AI agent.
Review this skill before installing. Use it only with websites you own or are authorized to test, verify the squirrel CLI source and version before running it, avoid piping raw audit output directly into an agent without treating it as untrusted data, and require explicit approval before config overwrites, self-updates, skill updates, subagents, or project edits.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T01 · Skill Instruction Hijacking
Warning
- Location
references/OUTPUT-FORMAT.md:195- Finding
Untrusted Website-Derived Report Content Piped Directly into an AI Agent
- Content
View full analysis
--format llm # Pipe directly to AI agent squirrel audit https://example.com --format llm | claude ``` ### Technical Analysis The Skill audits websites controlled by third parties and generates an LLM-oriented report containing crawl-derived information, including URLs, page-related items, issue descriptions, and other website metadata. The documentation explicitly recommends piping this report directly into an AI agent. A malicious website can deliberately publish text that resembles agent instructions. If such content is retained or reflected in the generated report, placing the report directly into an agent context creates an indirect prompt-injection boundary. The agent may confuse untrusted website data with trusted operational instructions. The output specification states that XML special characters are escaped. XML escaping mitigates structural parsing problems but does not neutralize semantic instructions expressed as ordinary text. The documentation does not require the receiving agent to treat all report fields as untrusted data, constrain report-driven actions, or obtain confirmation before following instructions appearing in the report. ### Attack Path 1. An attacker controls a website, page, URL, title, metadata field, or other content processed by the crawler. 2. The attacker inserts instruction-like content intended to manipulate an AI agent. 3. A user audits the attacker-controlled website with `squirrel audit --format llm`. 4. The generated report includes or reflects the attacker-controlled content. 5. Following the documented example, the repor ...[truncated 1389 chars]- Remediation
View remediation
Vulnerability Patterns
- Rogue AgentSelf-Modification, Session Persistence
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (5)
Self-Modification
High
- Category
- Rogue Agent
- Confidence
- 85% confidence
- Finding
The documented use of
squirrel init --forcecan overwrite an existing configuration file, which is a form of self-modification or destructive local state change. While not inherently malicious, it can erase project-specific settings or disrupt an existing audit setup if followed blindly by an agent.- Content
bash squirrel init -n my-project # overwrite existing config squirrel init -n my-project --force
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The skill is presented as a website auditing/reporting tool, but these instructions expand its behavior into modifying project files and implementing fixes. That broadens the trust boundary from read/report operations to write operations, increasing the chance of unintended code or content changes without clear user authorization.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The skill encourages auditing live websites and performing deeper scans that may impact the target, but it does not require confirming authorization, ownership, or permission to scan. In practice, this could prompt agents to crawl third-party sites in ways that raise legal, privacy, or operational concerns.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The workflow tells the agent to apply fixes and verify builds, which exceeds a reporting-oriented skill and introduces write/build execution behavior. This can lead to unauthorized repository modifications or execution of project checks in environments where the user only requested analysis.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
This section operationalizes an iterative remediation loop: fixing files, re-auditing, and continuing until a score target is reached. That turns an analysis skill into an autonomous code/content modification workflow, which is risky because optimization for a scanner score may cause incorrect, low-quality, or user-unapproved changes.
- Content
Static analysis
No suspicious patterns detected.