Agent-P Web Recon - 网站内容侦察

• Outcome: Review
• Latest audit: Sep 11, 2026 · 6:57 AM UTC
• Version: 1.0.0

Overview

This web reconnaissance skill is disclosed and dual-use, but its active probing and bypass-oriented guidance are broad enough to require careful review before installation.

Install only if you understand this as a dual-use web reconnaissance skill and will restrict it to owned systems, public OSINT, or explicitly authorized testing. Treat active mode, crawler impersonation, frontend bypass checks, API probing, and directory scanning as authorization-required actions; avoid running the scripts in privileged automation or with untrusted target input.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/recon.sh:98

Finding

User-Controlled Target Can Be Interpreted as curl Command-Line Options

Content

View full analysis

Vulnerability Details

File Location: scripts/recon.sh:98-103
Vulnerability Type: curl argument injection caused by missing input validation and option termination
Risk Level: Medium

Vulnerable Code

bash

# 2. Crawler simulation test
echo "[*] Testing crawler permissions..."
NORMAL_RESPONSE=$(curl -s -o /dev/null -w "%{http_code}" "$TARGET")
BOT_RESPONSE=$(curl -s -o /dev/null -w "%{http_code}" -A "Googlebot/2.1" "$TARGET")
echo "  Normal User-Agent: $NORMAL_RESPONSE"
echo "  Googlebot User-Agent: $BOT_RESPONSE"

The same unsafe pattern is also used for target-derived values at scripts/recon.sh:59, 70, 73, and 90.

Technical Analysis

TARGET is taken directly from the first command-line argument and is not validated as an HTTP or HTTPS URL. Although the variable is quoted, quoting only prevents shell word splitting and glob expansion; it does not prevent curl from interpreting an argument beginning with - as a command-line option.

The calls on lines 101-102 pass "$TARGET" directly to curl without an option terminator. A value such as -K/tmp/attacker.conf can therefore be interpreted as curl's -K configuration-file option rather than as a URL. A curl configuration file can specify URLs, uploads, output files, proxies, headers, and other behavior.

The vulnerable code does not constitute shell command injection because the value is quoted and is not evaluated by the shell. It is nevertheless command-line argument injection into curl.

Attack Path

1. An attacker obtains control of the target argument supplied to an automated or privileged invocation of the script.
2. The attacker creates or identifies a curl configuration file accessible to the account running the script.
3. The configuration file contains attacker-selected curl directives, potentially including an external URL and an upload-file directive referencing a file readable by the script account.

...[truncated 1481 chars]

Remediation

View remediation

Remediation Suggestions

1. Require a fully qualified http:// or https:// URL and reject all other schemes.

2. Reject input beginning with -, control characters, embedded credentials, or malformed hostnames.

3. Place curl's -- option terminator immediately before every user-derived URL:

   bash

   NORMAL_RESPONSE=$(curl -s -o /dev/null -w "%{http_code}" -- "$TARGET")
   BOT_RESPONSE=$(curl -s -o /dev/null -w "%{http_code}" -A "Googlebot/2.1" -- "$TARGET")
   

4. Parse and normalize the target once rather than constructing URLs through direct string concatenation.

5. If untrusted users can submit targets, resolve the hostname and block loopback, link-local, private, multicast, and cloud metadata addresses to reduce SSRF exposure.

6. Apply the same validation and -- termination to every curl invocation using TARGET or a target-derived URL.

7. Run reconnaissance under a dedicated, unprivileged account with restricted filesystem access and outbound network controls.

T08 · Insecure Dependencies

Note

• Location: scripts/recon.sh:108

Finding

Unpinned Third-Party Package Installation Guidance

Content

View full analysis

Vulnerability Details

File Location: scripts/recon.sh:108-113
Vulnerability Type: Unpinned dependency installation from the configured Python package index
Risk Level: Low

Vulnerable Code

bash

if command -v dirsearch &> /dev/null; then
    echo "[*] Starting directory scan..."
    dirsearch -u "$TARGET" -e php,html,js,json -o $REPORT_DIR/dirsearch.txt --quiet
    echo "  ✓ Scan results: $REPORT_DIR/dirsearch.txt"
else
    echo "  ⚠️  dirsearch is not installed; skipping directory scan"
    echo "  Install with: pip install dirsearch"
fi

The same unpinned installation command is documented at references/tools.md:62.

Technical Analysis

The project instructs users to execute:

bash

pip install dirsearch

No audited version, package hash, lock file, or trusted package index is specified. Consequently, the actual installed code depends on the state of the user's configured Python index at installation time.

Python package installation may execute package build or installation logic. An unpinned installation can therefore consume an unexpectedly changed, compromised, or substituted release. It also prevents reproducible review because a future installation may not retrieve the version considered during this audit.

The project does not automatically run this installation command, and there is no evidence that the named dirsearch package is currently malicious. The issue is unsafe supply-chain guidance rather than confirmed malicious dependency content.

Attack Path

1. A user follows the installation instruction printed by the script or listed in the documentation.
2. pip resolves dirsearch from the user's configured package index without an enforced version or integrity hash.
3. The index account, distribution channel, mirror, DNS path, or local pip configuration supplies a compromised or unintended release.
4. pip downloads and installs that release ...[truncated 905 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin a reviewed dependency version, for example through a requirements file rather than an unconstrained command.

2. Generate and verify cryptographic hashes using a hash-locked dependency workflow such as:

   bash

   python -m pip install --require-hashes -r requirements.txt
   

3. Document the expected trusted package index and avoid silently inheriting untrusted mirror configuration where feasible.

4. Record the reviewed package version and update it through an explicit dependency-review process.

5. Install the tool in an isolated virtual environment or container under a non-administrative account.

6. Replace both occurrences of pip install dirsearch with the same pinned, reproducible installation instructions.

7. Consider invoking the dependency from a locked container image with a verified image digest.

SkillSpector

Vulnerability Patterns

• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (7)

Intent-Code Divergence

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

This section explicitly describes bypass-oriented techniques: impersonating Googlebot to obtain alternate content and disabling JavaScript or inspecting network responses to get around client-side gating. Even if framed as authorized testing, these are practical instructions for circumventing access controls or content restrictions and can facilitate unauthorized data exposure.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence

Finding

The skill includes concrete shell and network-capable commands such as dirsearch, gobuster, gau, and waybackurls, but it does not declare any tool scope or permission boundaries. That omission makes it easier for an agent or operator to invoke active reconnaissance without explicit guardrails, auditability, or authorization checks.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The description, headings, instructions, and safety guidance are written in Chinese throughout the file. Under the policy rule, forcing a specific language without user opt-in is a natural-language policy violation unless the locale constraint is explicitly justified, which is not present here.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill states 'passive, no-trace' reconnaissance as a core principle, but later instructs active API probing, directory scanning, and other direct target interaction. This mismatch can mislead users into underestimating legal, detection, and operational risk, increasing the chance of unauthorized scanning under a false sense of safety.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The script's title, usage text, prompts, and status messages are written in Chinese, which imposes a specific language on users. There is no opt-in, fallback, or documentation indicating that the skill is intentionally limited to a Chinese-speaking or region-specific context.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

This markdown file presents all instructions, labels, and examples exclusively in Chinese. Under the policy rule for natural-language violations, forcing a specific language without user opt-in can be a locale policy issue when no choice or justification is provided.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

This code file contains natural-language usage text and prompts exclusively in Chinese, including the module docstring and runtime messages. That imposes a locale/language constraint on users without offering a choice or documenting that the tool is intentionally region-specific.

Content

No source excerpt is available for this finding.