Security audit

XPR Web Scraping

Security checks for vulnerabilities and agentic risk

Overview

This is a coherent web-scraping skill, but it needs review because it can make unrestricted outbound requests and forward user-supplied headers to any target.

Install only if you trust the runtime network environment and users who can invoke it. Avoid passing Authorization, Cookie, API key, or internal service headers, and consider adding destination allowlists, private-address blocking, redirect validation, and streaming response limits before broad use.

A.I.G

Vulnerability Patterns

Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T05 · Unauthorized Access and Privilege Escalation

Error

Location: src/index.ts:38
Finding: Unrestricted URL Fetching Enables Server-Side Request Forgery
Content: View full analysis
{ if (!url || !/^https?:\/\//i.test(url)) { throw new Error('Invalid URL'); } const page = await fetchPage(url); ``` ### Technical Analysis All three registered tools allow callers to make HTTP or HTTPS requests from the runtime environment. The validation verifies only that the input begins with `http://` or `https://`; it does not restrict the destination host or resolved IP address. Consequently, callers can target: - Loopback addresses such as `127.0.0.1` and `::1`. - RFC1918 private networks. - Link-local addresses. - Cloud instance metadata services. - Internal DNS names and otherwise inaccessible administration services. - IPv4 addresses represented using alternate textual encodings, unless canonicalized and checked. The use of `redirect: 'follow'` further permits a public URL to redirect the request to an internal d ...[truncated 1973 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: src/index.ts:49
Finding: Response Size Limit Is Enforced Only After Full Body Buffering
Content: View full analysis
MAX_BODY_SIZE) { throw new Error(`Response too large: ${contentLength} bytes (max ${MAX_BODY_SIZE})`); } const html = await resp.text(); if (html.length > MAX_BODY_SIZE) { throw new Error(`Response body too large: ${html.length} chars (max ${MAX_BODY_SIZE})`); } ``` ### Technical Analysis The implementation advertises a maximum response size of 5 MB, but the limit is not reliably enforced while downloading the response. The initial check trusts the optional `Content-Length` response header. A server can omit this header, provide an inaccurate value, or use chunked transfer encoding. In these cases, `resp.text()` reads and buffers the complete response before the subsequent length check runs. The post-read `html.length` check therefore detects an oversized response only after the process has already consumed the associated network bandwidth and memory. It also measures JavaScript string characters rather than the number of response bytes, so it is not an exact enforcement mechanism for the declared byte limit. The `scrape_multiple` tool fetches as many as ten URLs concurrently through `Promise.allSettled`. Multiple large responses can therefore be buffered simultaneously, amplifying memory pressure and bandwidth consumption. ### Attack Path 1. An attacker invokes a scraping tool with a URL under the attacker's control. 2. The remote server omits `Content-Length`, supplies a value below the configured limit, or streams the body using chunked transfer encoding. 3. The server sends a response substantially larger than 5 MB. 4. `resp.text()` continues reading and buffering the entire response because no incremental byte limit is applied. 5. The size check rejects ...[truncated 938 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 85% confidence
Finding: The skill enables network-capable web scraping functions but does not declare an explicit tool scope such as permissions or allowed-tools. This weakens policy enforcement and reviewability because the runtime may expose broader network access than intended, making misuse, overreach, or accidental access to unapproved external resources more likely.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The skill defines tools that fetch remote web pages, which causes outbound network requests and may disclose the user's requested targets and optional headers to external servers. While the descriptions explain functionality, they do not warn that using the tools sends data over the network or that custom headers will be transmitted.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The scrape_url tool accepts arbitrary custom headers and forwards them directly to any target URL. This can cause sensitive values such as Authorization, Cookie, or internal API headers to be sent to attacker-controlled hosts if an upstream agent or user passes them through, enabling credential leakage or cross-domain request abuse.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.