Security audit

web-crawler

Security checks for vulnerabilities and agentic risk

Overview

This is a coherent web crawling skill, but it can fetch arbitrary URLs from the user's machine without safeguards against internal-network or metadata-service access.

Install only if you are comfortable with a crawler that can make outbound requests from your machine and save fetched content locally. Avoid using it on untrusted, internal, authenticated, localhost, private-network, or cloud-metadata URLs unless you have containment such as network egress controls, and consider pinning dependencies before installation.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Error

Location: scripts/web_fetch_enhanced.py:212
Finding: Unrestricted URL Fetching Enables Server-Side Request Forgery
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: SKILL.md:170
Finding: Unpinned Third-Party Dependencies and Browser Artifacts
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (7)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: The declared description presents a full web crawling/scraping system with page fetching, rendering, selector-based extraction, custom JS execution, and whole-site BFS crawl support. The supplied code chunk is much narrower: it is a content-cleaning utility that processes already-provided HTML and extracts readable text/title/publish time. While 'content cleaning' is mentioned in the description and this module could be a supporting component of such a tool, this chunk by itself does not implement the core declared behaviors. Therefore the description does not accurately represent what this code chunk actually does.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: The declared description includes two major capability groups: (1) single-page precise scraping with CSS selectors/custom JS/automatic fallback, and (2) full-site BFS crawling with resume and content cleaning, plus a Playwright + requests dual-fetch strategy. The supplied code clearly matches the second group: it performs BFS crawling, same-domain filtering, checkpoint/resume, content cleaning, link discovery, and JSON result saving. However, the first group of features is absent. There is no interface or logic for selecting page elements via CSS selectors, no custom JavaScript execution for user-defined extraction, and no static HTTP retrieval via requests as a fallback when Playwright is unsuitable. Because these are substantive claimed capabilities rather than minor implementation details, the description materially overstates what this code chunk does.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The code substantially matches the single-page fetching portion of the description: it supports CSS selector extraction, custom JS execution, automatic fallback from Playwright to requests, and content cleaning before markdown output. However, a major part of the declared purpose is missing: there is no implementation of whole-site BFS crawling, no link traversal, no crawl frontier/queue management, and no checkpoint or resume functionality. The script operates on one URL at a time and returns that page’s processed content. Because the declared description includes significant crawling capabilities absent from the code, this is a description-behavior mismatch.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 92% confidence
Finding: The skill documents capabilities that clearly involve network access and reading/writing files, but it does not declare any tool scope or permissions boundary. In an agent environment, missing explicit scope increases the chance of overbroad execution, accidental data access, or use of capabilities the user did not meaningfully consent to.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The skill encourages fetching and crawling arbitrary URLs but does not warn users that this will generate outbound network requests to third-party sites. In agent settings, that omission can cause privacy leakage of user browsing targets, internal URLs, or sensitive research intent.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The skill describes automatic result persistence and checkpointing but does not clearly warn that crawl mode writes collected content and progress data to disk. This can create unintended local data retention, including storage of sensitive page content, URLs, or metadata that other tools or users on the system may later access.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The requests fallback hard-codes the Accept-Language header to en-US,en;q=0.5, which imposes a specific language/locale on fetched content. This is a natural-language policy concern because users are not given a choice or override path through the CLI for locale selection.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.