Web Retrieval

• Outcome: Review
• Latest audit: Sep 16, 2026 · 8:59 AM UTC
• Version: 1.0.0

Overview

This web retrieval skill is mostly coherent, but it needs review because it broadly replaces normal web fetching with unrestricted host-network crawling and local output writes.

Install only if you are comfortable with an agent using your machine to fetch and crawl URLs through Scrapling. Avoid using it on internal, localhost, private-network, cloud metadata, or token-bearing URLs unless you explicitly intend that access, and direct output only to paths you are willing to fill with untrusted remote content.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/fetch:34

Finding

Unrestricted URL Fetching Enables Server-Side Request Forgery

Content

View full analysis

Vulnerability Details

File Location: scripts/fetch:34-45, 58; scripts/crawl:53-70, 82-83, 108-109, 132-134
Vulnerability Type: Server-Side Request Forgery (SSRF, CWE-918)
Risk Level: High

The scripts accept arbitrary URLs and pass them to the network-capable Scrapling executable without validating the URL scheme, hostname, resolved IP address, or redirect destinations.

Vulnerable Code

In scripts/fetch, the URL is accepted as a positional argument and passed directly to Scrapling:

python

def parse_args():
    p = argparse.ArgumentParser(add_help=False)
    p.add_argument("url")
    p.add_argument("output_file", nargs="?", default=None)
    p.add_argument("--mode", choices=["get", "fetch", "stealthy"], default=None)
    p.add_argument("--selector", "-s", default=None)
    p.add_argument("--wait", type=int, default=0)
    p.add_argument("--wait-selector", default=None)
    p.add_argument("--solve-cloudflare", action="store_true")
    p.add_argument("--text", action="store_true")
    p.add_argument("--html", action="store_true")
    p.add_argument("--no-resources", action="store_true")
    p.add_argument("--timeout", type=int, default=30000)
    p.add_argument("--network-idle", action="store_true")
    p.add_argument("--proxy", default=None)
    return p.parse_args()

python

def build_cmd(mode, url, outfile, args):
    cmd = [SCRAPLING, "extract", mode, url, outfile]

In scripts/crawl, both a start URL and a file containing multiple URLs can supply unrestricted destinations:

python

def parse_args():
    p = argparse.ArgumentParser(description=__doc__, formatter_class=argparse.RawDescriptionHelpFormatter)
    p.add_argument("start_url", nargs="?", default=None)
    p.add_argument("--urls-file", default=None)
    p.add_argument("--depth", type=int, default=1)
    p.add_argument("--same-domain", action="store_true", default=True)
    p.add_argument
...[truncated 4830 chars]

Remediation

View remediation

Remediation Suggestions

Implement one shared URL-validation function and invoke it for every initial URL, URL-list entry, discovered crawl link, and redirect destination.

1. Permit only explicitly required schemes, normally https and optionally http.
2. Reject malformed URLs, missing hostnames, nonstandard URL encodings, and URLs containing embedded usernames or passwords.
3. Resolve the hostname before connecting and inspect every resulting IPv4 and IPv6 address.
4. Reject loopback, private, link-local, multicast, unspecified, reserved, and other non-global address ranges.
5. Normalize IPv4 and IPv6 representations to prevent bypasses using alternate numeric formats or IPv4-mapped IPv6 addresses.
6. Disable automatic redirects or validate every redirect target before following it.
7. Mitigate DNS rebinding by ensuring the validated address is the address used for the connection, or by validating the actual peer address after connection.
8. Prefer an explicit hostname allowlist when the workflow operates on known sites.
9. Apply equivalent validation to proxy configuration, or remove user-controlled proxy support when it is unnecessary.
10. Add network-layer egress controls blocking loopback, private networks, link-local ranges, and cloud metadata services as defense in depth.
11. Add tests covering IPv4, IPv6, decimal or encoded address forms, redirects, DNS rebinding scenarios, URL credentials, and mixed-case or malformed schemes.
12. Return a clear validation error without attempting a network connection when a destination is rejected.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (4)

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence

Finding

The skill exposes capabilities that imply shell execution, network access, and local file read/write, but it does not declare any explicit tool scope or permissions boundary. This increases the chance of over-broad agent execution, misuse in unintended contexts, and unnoticed access to local files or external destinations without clear policy constraints.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The trigger description is very broad, including nearly any web_fetch task and stating it is preferred for all URL retrieval. That can cause the skill to be invoked in situations where a simpler or more constrained tool would suffice, unnecessarily exposing shell, network, and file-writing behaviors.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill is centered on external web retrieval and crawling, but it does not clearly warn that using it sends requests, URLs, headers, and potentially browsing fingerprints to third-party sites. In sensitive environments, this can disclose user intent, internal URLs, tokens embedded in URLs, or other operational metadata.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The skill includes examples that write fetched content to local files, but it does not warn users that retrieved remote content may be persisted on disk. This can lead to accidental storage of sensitive, copyrighted, malicious, or simply unexpected content in local paths, especially when used by an automated agent.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.