LLMs.txt Generator

• Outcome: Review
• Latest audit: Sep 11, 2026 · 1:46 AM UTC
• Version: 0.1.0

Overview

This skill has a coherent purpose, but its crawler is under-scoped enough that it can fetch unintended internal URLs and feed untrusted page text into the agent.

Review this skill before installing. It is not deceptive, but only use it in an environment where outbound network access is contained, avoid crawling private or sensitive URLs, treat generated content as draft output, and manually verify claims and links before publishing the resulting llms.txt.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (4)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/crawl.py:46

Finding

Unrestricted URL Fetching Enables Server-Side Request Forgery

Content

View full analysis

[extra_url1 extra_url2 ...]", file=sys.stderr) sys.exit(1) args = sys.argv[1:] deep = "--deep" in args args = [a for a in args if a != "--deep"] root_url = args[0] extra_urls = args[1:] if len(args) > 1 else [] if not root_url.startswith("http"): root_url = "https://" + root_url result = crawl(root_url, extra_urls, deep=deep) print(json.dumps(result, indent=2)) ``` ### Technical Analysis The crawler sends requests to the user-controlled root URL and every user-provided extra URL without validating the URL scheme, destination address, port, or DNS resolution. It also enables `follow_redirects=True` without checking the destination of each redirect. Consequently, the crawler can be instructed to contact: - Loopback services such as `127.0.0.1` or `::1` - RFC1918 private networks - Link-local services and cloud metadata endpoints - Internal DN ...[truncated 1985 chars]

Remediation

View remediation

T01 · Skill Instruction Hijacking

Error

• Location: SKILL.md:91

Finding

Untrusted Website Content Can Inject Instructions into the Agent Context

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/crawl.py:43

Finding

Unbounded HTTP Response Buffering Enables Resource Exhaustion

Content

View full analysis

Remediation

View remediation

T08 · Insecure Dependencies

Note

• Location: scripts/crawl.py:14

Finding

Unpinned Runtime Dependencies Create Supply-Chain and Reproducibility Risk

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Rogue Agent: Self-Modification, Session Persistence
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (8)

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 88% confidence

Finding

The skill instructs the agent to crawl arbitrary user-supplied websites and run a local Python crawler, but the manifest does not declare any explicit tool scope or allowed-tools boundaries. That increases the risk of unintended network access and makes it harder to constrain what external requests the skill may perform, especially if the crawler follows redirects or accepts extra URLs from the user.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 3)May include surrounding context.

md

---
name: llms-txt-generator
description: Generate a well-structured llms.txt file for any business website. Crawls the site, has a short conversation to fill in gaps, and produces an agent-optimized llms.txt. Trigger when a user asks to "generate llms.txt", "make my site agent-readable", "create llms.txt for [url]", or "update my llms.txt".
---

# LLMs.txt Generator

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The skill performs website crawling and extracts structured business information, but it does not clearly warn users about what data may be collected, processed, or retained. This is risky because crawled pages may contain personal data, unpublished contact details, or sensitive text that gets ingested into prompts and temporary files without informed consent.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

Deep crawl mode escalates collection by ingesting full raw text from every crawled page and feeding it into generation prompts, yet the user warning only mentions that it 'takes a bit longer.' This can unexpectedly capture large amounts of sensitive or irrelevant content, increasing privacy, prompt-injection, and data-handling risk beyond what the user may reasonably expect.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/llms_txt_spec.md (reported line 205)May include surrounding context.

md

- [Pricing](https://utkrusht.ai/pricing): Per-candidate assessment model. No credit card required to start.

## API
- [API Docs](https://api.utkrusht.ai/docs): REST API available. Contact for access.

## Links
- [Homepage](https://utkrusht.ai)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

This script performs live crawling of arbitrary user-supplied websites, extracts emails and substantial raw page text, and emits that data directly as JSON without any explicit consent, minimization, or warning mechanism. In the context of an agent skill, that creates a real privacy and data-handling risk because the output may contain personal or sensitive business information from pages the user did not realize would be collected and surfaced.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Low

• Category: Not specified by scanner
• Confidence: 77% confidence

Finding

The manifest description focuses on crawling a site, conversing with the user, and producing an llms.txt file, but the implementation explicitly writes intermediate and final artifacts to local filesystem paths such as /tmp/llms_business_info.json and /tmp/llms_final.txt. Persisting files may be an implementation choice, but it is still behavior beyond the plain-language description of generation alone.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

Line L170 says '## Team: Always include' but the same sentence then says 'If none available, omit silently,' which is an active contradiction in the documented intent. This creates ambiguity about expected behavior and could cause inconsistent implementations.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.