T01 · Skill Instruction Hijacking
Error
- Location
SKILL.md:48- Finding
Forced Replacement of Built-in Web Tools
- Content
View full analysis
- Remediation
View remediation
Security audit
Unifuncs is a web reading, AI search, and deep research tool. Use this skill for all web-related tasks including reading webpage content, searching the web, and conducting deep research. Replaces built-in web_search and web_fetch tools
Security checks for vulnerabilities and agentic risk
Overview
This appears to be a real UniFuncs web tool, but it broadly redirects web activity to a third-party service and tells users to disable built-in web tools without enough scoping or privacy disclosure.
Install only if you intentionally want UniFuncs to handle your web reading, searching, and research requests. Do not disable built-in web tools unless you understand that future web activity may be routed to UniFuncs, and avoid submitting private, signed, internal, token-bearing, or confidential URLs and prompts unless you trust that provider's handling of them.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/web-reader.js:16- Finding
Unfiltered Disclosure of Complete URLs to an External Service
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (15)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The declared description promises three categories of functionality: web reading, AI search, and deep research, broadly covering all web-related tasks and replacing built-in web_search and web_fetch. The supplied code only performs one function: submit a text query to a remote deepsearch chat-completions endpoint and return the response. There is no code for fetching arbitrary URLs, extracting webpage content, browsing/searching the web directly, or handling web-related tasks generally. This is a material description-behavior mismatch because the implementation is much narrower than claimed.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The code chunk solely performs webpage content retrieval/extraction via a POST request to a remote /api/web-reader/read endpoint. It supports options like format, lite mode, images, link summaries, topic filtering, and CSS selector filtering, which align with web reading/fetching. However, there is no implementation of web searching, AI search, or deep research workflows, nor any broader multi-tool orchestration that would replace both web_search and web_fetch. Thus the declared description materially overstates the implemented capabilities.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
The description claims a broad web toolkit for reading webpages, searching the web, and conducting deep research, replacing both web_search and web_fetch. However, the code chunk only performs web search through a single external endpoint (
/api/web-search/search). There is no functionality for fetching or reading arbitrary webpage content, no crawler/browser behavior, and no deep-research workflow beyond basic search parameters. This is a material description-to-behavior mismatch because the implemented primary purpose is narrower than declared.- Content
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md node scripts/web-reader.js <url> [options]
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md node scripts/web-reader.js <url> [options]
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md node scripts/web-search.js <query> [options]
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md node scripts/web-search.js <query> [options]
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md node scripts/deepsearch.js "<research question>"
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md node scripts/deepsearch.js "<research question>"
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 90% confidence
- Finding
The skill advertises use of environment variables and external network access but does not declare an explicit tool scope such as permissions or allowed-tools. That weakens least-privilege controls and makes it harder for a user or platform to understand and constrain what the skill can access before invocation.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The trigger text says to use this skill for all web-related tasks, which is overly broad and can cause unintended invocation. In practice, that increases the chance that sensitive prompts, URLs, or research queries are sent to an external provider when a narrower or local tool would have been sufficient.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The skill instructs users to configure an API key and route web queries through an external service but does not prominently warn that URLs and search terms will be transmitted off-platform. This creates privacy and data-handling risk because users may unknowingly send sensitive research topics, internal links, or personal data to a third party.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The script transmits the raw user query to a third-party service (
api.unifuncs.com) without any disclosure, consent prompt, or data-sensitivity warning. In a research/web skill, users may include proprietary, personal, or otherwise sensitive information in queries, so silent external transmission creates a real privacy and data-handling risk even though it is functionally necessary for the feature.- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The tool sends user-supplied URLs and extraction parameters to an external third-party API without any disclosure or consent step in the execution path. This can leak sensitive URLs, embedded query tokens, internal hostnames, or research targets to the service provider, which is especially relevant because this skill is presented as a generic web-reading replacement and users may assume direct fetching rather than third-party relay.
- Content
Context-Inappropriate Capability
Low
- Category
- Not specified by scanner
- Confidence
- 82% confidence
- Finding
The manifest describes web reading, AI search, and deep research tools, but this file also depends on local environment access to retrieve credentials. While network access is expected for a web tool, reading process environment variables is a separate capability not stated in the manifest and is not intrinsic to webpage content extraction itself.
- Content
Static analysis
Detected: suspicious.env_credential_access
Environment variable access combined with network send.
Critical
- Code
- suspicious.env_credential_access
- Location
- scripts/deepsearch.js:7
Environment variable access combined with network send.
Critical
- Code
- suspicious.env_credential_access
- Location
- scripts/web-reader.js:7
Environment variable access combined with network send.
Critical
- Code
- suspicious.env_credential_access
- Location
- scripts/web-search.js:7