Security audit

web-fetch

Security checks for vulnerabilities and agentic risk

Overview

This web-scraping skill is not plainly malicious, but it needs review because it includes crawler-defense bypass guidance, robots.txt bypass/fail-open behavior, and broad local learning logs.

Install only if you are comfortable managing scraping compliance yourself. Use it only on sites where you have permission, avoid the anti-detection/proxy guidance unless explicitly authorized, do not rely on its robots.txt handling as a compliance guarantee, and treat learned_patterns.json as a local activity log that may contain sensitive notes or preferences.

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (8)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 90% confidence
Finding: The skill advertises and demonstrates network access and persistent file writes, but the manifest does not declare those capabilities or permissions. Undeclared capabilities reduce transparency and policy enforcement, making it easier for the skill to exfiltrate data, store tracking artifacts, or perform actions the host/user did not explicitly authorize.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 94% confidence
Finding: The declared purpose is web scraping, but the document also describes a self-learning persistence mechanism that records success/failure history, high-frequency error patterns, and cross-session memory. That is materially different behavior because it creates durable usage telemetry and potentially stores user or target-site information outside the stated core function, increasing privacy and abuse risk.

Intent-Code Divergence

Medium

Confidence: 93% confidence
Finding: The skill's stated safety boundary says it will not be used for abusive scraping, but earlier sections explicitly recommend stealth patches, residential proxy rotation, and human-like behavior to evade anti-bot defenses. This contradiction is dangerous because it normalizes circumvention features that can facilitate unauthorized access at scale while presenting the tool as compliant.

Description-Behavior Mismatch

Medium

Confidence: 95% confidence
Finding: The skill prominently claims automatic respect for robots.txt, yet the usage examples expose a --no-robots option to bypass that protection. This is dangerous because it undermines user and platform trust, and it directly enables policy evasion against sites that explicitly disallow automated fetching.

Context-Inappropriate Capability

High

Confidence: 95% confidence
Finding: This module explicitly presents itself as a generic, cross-skill learning/telemetry component rather than functionality needed for a web-fetch skill. It enables persistent collection of usage history and preferences across arbitrary skills, which expands data collection scope beyond the stated purpose and creates privacy and profiling risk if reused broadly.

Description-Behavior Mismatch

High

Confidence: 97% confidence
Finding: The code persists user preferences, operation history, error notes, and self-reflection data to disk in learned_patterns.json, which goes beyond web scraping into behavioral tracking and adaptive profiling. Because skill_dir can point to arbitrary directories and the component is designed for any skill, it increases the chance of collecting unrelated sensitive data and normalizing unauthorized telemetry.

Intent-Code Divergence

Medium

Confidence: 95% confidence
Finding: The script advertises that it respects robots.txt, but the implementation allows scraping whenever robots.txt cannot be fetched or parsed. In a web-scraping skill, that mismatch matters because users may rely on the claim for compliance while the code silently broadens access to sites that intended to restrict crawling.

Intent-Code Divergence

Low

Confidence: 97% confidence
Finding: The inline comment labels a permissive fallback as a 'conservative default,' but the code actually permits crawling on robots.txt failures. This is dangerous because it can mislead maintainers and reviewers into overlooking behavior that bypasses intended crawler restrictions, especially in a scraping-focused tool.

Static analysis

No suspicious patterns detected.