Web Retrieval

Security checks across malware telemetry and agentic risk

Overview

This skill performs disclosed web fetching and crawling, with expected network access and user-chosen file outputs, and no evidence of hidden or malicious behavior.

Install this only if you want agents to make direct web requests and optionally crawl sites from your machine. Use it only for URLs and domains you are allowed to access, be careful with stealth or Cloudflare-bypass modes, and choose output paths that will not overwrite important files or retain sensitive fetched content longer than intended.

SkillSpector

By NVIDIA

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Missing User Warnings

Medium

Confidence: 83% confidence
Finding: The examples explicitly write fetched content to local files without warning about overwriting existing paths, storing potentially sensitive retrieved data, or using safe temporary/output directories. In an agent setting, this can lead to unintended persistence of untrusted or sensitive content on disk and accidental clobbering of user files.

Missing User Warnings

Medium

Confidence: 89% confidence
Finding: The crawl examples encourage bulk retrieval, JSON export, and checkpoint storage, but omit warnings that these operations can accumulate large volumes of remote content locally and persist crawl state across runs. In practice, this increases the risk of excessive disk usage, retention of sensitive data, and unintended storage of content the user did not expect to keep.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal