T09 · Insecure Skill Coding Practices
Error
- Location
scripts/extractor.py:130- Finding
Unrestricted URL Fetching Enables Server-Side Request Forgery
- Content
View full analysis
- Remediation
View remediation
Security audit
网页内容提取小助手
Security checks for vulnerabilities and agentic risk
Overview
This is a coherent web extraction skill, but it can fetch arbitrary user-provided URLs without safeguards against private or internal network targets.
Install only if you are comfortable with the skill making outbound requests to URLs you provide. Do not use it on localhost, private network addresses, cloud metadata endpoints, intranet pages, authenticated links, or URLs containing secrets unless the runtime blocks those destinations. Prefer a version that pins dependencies and adds private-address and redirect validation.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (10)
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The README describes extracting content from '任意网页' but does not clearly warn that the skill makes outbound requests to arbitrary URLs and may transmit user-requested destinations to remote hosts. In an agent setting, this omission can mislead users about privacy and security implications, making accidental access to sensitive endpoints, internal services, or user-specific URLs more likely.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The README advertises a very broad natural-language trigger ('帮我提取 ... 的内容') that could be invoked in ordinary conversation without a strong capability boundary or confirmation step. In an agent environment, this increases the chance of unintended network access to user-supplied URLs, including internal, sensitive, or tracking URLs, which can lead to privacy issues or SSRF-like behavior depending on the runtime.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The description and user-facing instructions are presented in Chinese, which effectively forces a specific language for users without any opt-in or explanation. Under the policy, locale or language constraints should either be optional for the user or clearly documented as justified.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The script's natural-language interface, prompts, help text, and status messages are consistently presented only in Chinese. Per the policy, forcing a specific language without user opt-in or documented justification is a language/locale policy violation.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The skill performs a network request to a user-supplied URL without any explicit warning or consent step, which can cause the user to contact an external site and disclose request metadata such as IP address, User-Agent, and access timing. In a network-enabled agent context, this is a real privacy and safety issue because users may provide sensitive internal or personal URLs without realizing the request will be made directly.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The skill explicitly accepts arbitrary web URLs and requires network access, but the documentation does not warn users that it will fetch untrusted remote content and process attacker-controlled HTML. This can lead to unsafe use, including unintended requests to sensitive internal endpoints or ingestion of malicious content, especially if users assume the skill is harmless utility tooling.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
该安装文档全文以中文编写，未说明这是面向特定中文用户群的区域性技能，也未提供其他语言选项或用户选择机制。根据语言/区域策略，未经用户选择而强制单一语言属于自然语言层面的政策风险。
- Content
Unpinned Dependencies
Low
- Category
- Supply Chain
- Confidence
- 96% confidence
- Finding
The dependency is specified with a lower bound only, so builds can resolve to different future versions and are not reproducible. This increases supply-chain risk because a later vulnerable or malicious release could be installed without any change to the skill source, and it also makes it hard to verify whether known advisories affect the deployed version.
- Content
text requests>=2.28.0 beautifulsoup4>=4.11.0
Unverifiable Dependency: requests has 16 known advisory(ies) (CVE-2014-1830 (Exposure of Sensitive Information to an Unauthorized Actor in Requests); CVE-2024-47081 (Requests vulnerable to .netrc credentials leak via malicious URLs); CVE-2024-35195 (Requests `Session` object does not verify requests after making first request wi) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected
Low
- Category
- Supply Chain
- Confidence
- 90% confidence
- Finding
The manifest does not pin requests, and requests has multiple known advisories across versions, so the actual installed version cannot be verified as safe. In a network-enabled web-content-extractor, this matters more because requests is directly in the path of fetching attacker-controlled URLs, increasing the relevance of HTTP/client-side library flaws such as credential leakage or TLS/redirect handling issues.
- Content
Unpinned Dependencies
Low
- Category
- Supply Chain
- Confidence
- 95% confidence
- Finding
beautifulsoup4 is also unpinned, which creates non-reproducible environments and avoidable supply-chain exposure. Even if no specific advisory is cited here, allowing any future release means the skill may silently pick up breaking, vulnerable, or compromised versions.
- Content
text requests>=2.28.0 beautifulsoup4>=4.11.0
Static analysis
No suspicious patterns detected.