Security audit

Trirank Geo Audit

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent website audit tool, but its instructions allow broad URL fetching with redirects and response-body capture without safeguards against internal or private-network targets.

Review before installing in environments with access to internal networks or cloud metadata services. Use it only for public websites you intend to audit, and prefer a fetch tool or runtime policy that blocks private, loopback, link-local, metadata, and unsafe redirect targets.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.md:23
Finding: Unrestricted User-Controlled URL Fetching Enables Server-Side Request Forgery
Content: View full analysis
/` | Also capture the `X-Robots-Tag` response header. | | Robots | `https:///robots.txt` | A 404 means "no robots.txt" — do **not** parse an error page body as robots rules. | | Sitemap | `https:///sitemap.xml` | Body must actually look like a sitemap (`/llms.txt` | Must return < 400 with a non-empty text body. | ``` ### Technical Analysis The skill directs the agent to fetch resources from a user-supplied domain and explicitly follow HTTP redirects. It does not impose restrictions on the destination host, resolved IP address, port, or redirect targets. There are no safeguards requiring the agent to reject: - Loopback destinations such as `127.0.0.1` or `::1` - Private network ranges such as `10.0.0.0/8`, `172.16.0.0/12`, or `192.168.0.0/16` - Link-local addresses, including cloud instance metadata services - Internal DNS names - IPv4 addresses represented through alternative numeric encodings - Public hosts that redirect to internal destinations - DNS records that change after initial validation Merely normalizing the supplied URL, preferring HTTPS, and noting the final host does not prevent SSRF. Validation must occur after DNS resolution and again for every redirect. Because the procedure requires recording response bodies, a successful SSRF request could also cause internal response content to be processed or included in an audit ...[truncated 1963 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep