T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/scrape_zoomin.py:14- Finding
Unrestricted Browser Navigation Enables Server-Side Request Forgery
- Content
View full analysis
- Remediation
View remediation
Security audit
Zoomin Docs Portal Scraper Tool
Security checks for vulnerabilities and agentic risk
Overview
The skill mostly matches its scraping purpose, but it lets a supplied URL list drive a browser to any address and write scraped output locally, so it needs review before installation.
Install only if you trust the URL list source and run it in a constrained environment. Use a dedicated virtual environment, choose an output directory that can be safely populated, avoid URLs containing secrets, and restrict network access or validate URLs to expected Zoomin documentation domains before running.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)
T08 · Insecure Dependencies
Note
- Location
SKILL.md:17- Finding
Playwright and Chromium Are Installed Without Version or Integrity Pinning
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (3)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The declared description says this skill scrapes documentation from Zoomin portals using Playwright to handle dynamic web content. The supplied code does none of that: it imports only os and json, opens local files passed on the command line, reads their contents, extracts a topic from the filename, truncates content for a summary, assigns a category using keyword rules, and outputs JSON. Its primary purpose is batch analysis of already-saved documentation files, not browser-based scraping of web portals. This is a clear description-behavior mismatch.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 87% confidence
- Finding
The skill describes capabilities that require reading URL lists, writing scraped output to disk, and making network requests, but it does not declare any tool scope or permissions boundaries. In an agent environment, missing explicit scoping increases the risk of unintended file or network access because operators cannot clearly constrain what the skill is allowed to do.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The markdown explains that the skill processes URLs and saves extracted content to an output directory, but it does not explicitly warn the user that running the skill will create local files and potentially overwrite or populate a directory with scraped data. For markdown files, user-facing warnings are expected when behavior affects user data or system state.
- Content
Static analysis
No suspicious patterns detected.