Security audit

AEO Prompt Research (Free)

Security checks for vulnerabilities and agentic risk

Overview

The skill’s AEO research purpose is coherent, but its optional shell crawler can be directed at internal or private network targets without safeguards.

Review before installing in any environment with access to private networks or cloud metadata services. Prefer web_fetch for public pages, and only run the shell crawler for domains you intentionally trust after adding public-host validation or network egress controls.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/crawl_site.sh:9
Finding: Unrestricted Website Crawling Enables Server-Side Request Forgery
Content: View full analysis
[output_file]}" OUTPUT="${2:-/dev/stdout}" # Normalize domain — strip protocol and trailing slash DOMAIN="${DOMAIN#https://}" DOMAIN="${DOMAIN#http://}" DOMAIN="${DOMAIN%/}" BASE="https://${DOMAIN}" ``` ```bash for path in "${PAGES[@]}"; do url="${BASE}${path}" status=$(curl -s -o /dev/null -w "%{http_code}" -L --max-time 10 "$url" 2>/dev/null || echo "000") if [ "$status" = "200" ]; then echo "## ${url}" >> "$OUTPUT" echo "" >> "$OUTPUT" # Extract text content, strip HTML tags, collapse whitespace curl -sL --max-time 15 "$url" 2>/dev/null \ | sed 's/]*>.*<\/script>//g' \ | sed 's/]*>.*<\/style>//g' \ | sed 's/<[^>]*>//g' \ | sed 's/ / /g; s/&/\&/g; s/<//g' \ | tr -s '[:space:]' '\n' \ | head -200 \ >> "$OUTPUT" ``` ### Technical Analysis The script accepts a caller-controlled domain and interpolates it directly into URLs passed to `curl`. It does not validate the hostname, port, resolved IP addresses, or URL components. Consequently, a caller can direct requests toward loopback, private, link-local, or other internal network destinations. Both `curl` invocations also use `-L`, which follows redirects. Redirect destinations are not validated, allowing an attacker-controlled public HTTPS endpoint to redirect the crawler to an internal HTTP or HTTPS service. This can bypass the initial construction of an `https://` URL. The script performs the request twice: once to determine the HTTP status and again to retrieve the response body. If the destination returns status 200, up to 200 lines of processed response content are written to the output. DNS rebinding is also possible because no resolved-addr ...[truncated 1850 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 83% confidence
Finding: The skill invokes a shell capability via scripts/crawl_site.sh <domain> but does not declare an explicit tool scope such as permissions or allowed-tools. This creates an avoidable ambiguity where an agent may permit broader execution than intended, and because the script parameter is a user-provided domain, any shell-based path increases the risk of unsafe command handling or unauthorized local execution.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.