T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/deadlinks.py:218- Finding
Unrestricted URL Fetching Enables Server-Side Request Forgery
- Content
View full analysis
- Remediation
View remediation
Security audit
Deadlinks
Security checks for vulnerabilities and agentic risk
Overview
This is a straightforward broken-link checker that reads Markdown files and optionally makes outbound web requests, with no hidden persistence or credential behavior found.
Installers should treat this as a normal link-checking utility, but avoid running external checks or crawl mode on untrusted documents or from sensitive internal networks unless outbound targets are acceptable. It is best used with explicit paths, shallow crawl depth, reasonable timeouts, and network controls when needed.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 95% confidence
- Finding
The skill advertises and demonstrates filesystem reading and network access, but it does not declare any explicit tool scope such as permissions or allowed-tools. That creates an authorization gap: an agent may invoke the skill with broader file-read or outbound network capabilities than a user expects, enabling unintended access to local documents or requests to arbitrary URLs during link checking.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The README explicitly advertises checking external HTTP(S) links and website crawling, but it does not warn users that running the tool will initiate outbound requests to user-provided and discovered URLs. This can surprise users in sensitive environments and may cause unintended network access, metadata leakage, or interaction with internal resources if used on untrusted content.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
This skill performs outbound HTTP requests to arbitrary URLs found in local Markdown files and during site crawling without an explicit safety confirmation or warning at execution time. In an agent setting, that can cause unintended network access to internal services, sensitive endpoints, or attacker-controlled URLs embedded in documents, creating SSRF-like exposure and privacy leakage even though the tool's stated purpose is link checking.
- Content