alibabacloud-website-probe

• Outcome: Review
• Latest audit: Aug 21, 2026 · 2:24 AM UTC
• Version: 0.0.1

Overview

The skill mostly does what it claims, but it sends probe targets to a public third-party service and under-discloses session caching and dependency risks.

Review before installing. Do not use this skill with private/internal hosts, signed URLs, credential-bearing query strings, or confidential pre-production endpoints unless you are comfortable sending them to boce.aliyun.com. Prefer installing in an isolated environment with current dependency resolution, and clear the ~/.qoderwork/cache/boce_session.json cache if you want to remove the anonymous probing session state.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 93% confidence
• Finding: The skill instructs the agent to use shell, network, file read/write, and environment-variable inputs, but it declares no explicit permissions or capability boundaries. That mismatch is dangerous because it obscures the skill's real execution surface, making it harder for a runtime or reviewer to enforce least privilege and increasing the risk of unintended command execution, network egress, or filesystem access.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The guide explicitly states that target URLs are submitted to a public external probing platform, but it does not warn that internal URLs, sensitive endpoints, tokens in query strings, or confidential hostnames may be disclosed to that third party. In this skill context, that omission is meaningful because the skill is designed to transmit user-supplied network targets to an external service by default.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The script persists session cookies and the XSRF token to a predictable file under the user's home directory, enabling reuse of authenticated state across runs. Although file mode 0600 reduces exposure to other local users, the cached credentials are still sensitive and could be abused by local malware, backup/sync leakage, or other processes running as the same user, especially because this happens without explicit disclosure or consent.

Known Vulnerable Dependency: requests==2.28 — 8 advisory(ies): CVE-2024-47081 (Requests vulnerable to .netrc credentials leak via malicious URLs); CVE-2024-35195 (Requests `Session` object does not verify requests after making first request wi); CVE-2026-25645 (Requests has Insecure Temp File Reuse in its extract_zipped_paths() utility func) +5 more

High

• Category: Supply Chain
• Confidence: 97% confidence
• Finding: The dependency specification permits installation of requests 2.28.x, and the supplied advisory context indicates that this version line is affected by multiple known security issues. Because this skill performs network probing against arbitrary websites and APIs, it is more exposed to malformed URLs, redirects, proxy interactions, and hostile server responses, which makes use of a vulnerable HTTP client especially risky.

Known Vulnerable Dependency: urllib3==1.26 — 10 advisory(ies): CVE-2025-66471 (urllib3 streaming API improperly handles highly compressed data); CVE-2024-37891 (urllib3's Proxy-Authorization request header isn't stripped during cross-origin ); CVE-2026-21441 (Decompression-bomb safeguards bypassed when following HTTP redirects (streaming ) +7 more

High

• Category: Supply Chain
• Confidence: 98% confidence
• Finding: The dependency specification permits installation of urllib3 1.26.x, and the finding indicates this version family carries multiple known vulnerabilities involving redirect handling, proxy-authorization leakage, and compressed response processing. In a website probing skill that intentionally connects to many remote, potentially untrusted endpoints across regions, those attack surfaces are directly relevant and increase the likelihood of exploitation or incorrect security behavior.

Static analysis

No suspicious patterns detected.