Clank Website Monitor

• Outcome: Review
• Latest audit: Sep 16, 2026 · 3:40 AM UTC
• Version: 1.0.0

Overview

The skill is a plausible website monitor, but it needs review because it can fetch arbitrary URLs and write monitor files outside its intended directory through an unchecked name parameter.

Review before installing. Use only with trusted URLs and names, avoid monitoring internal or sensitive endpoints, and prefer a revised version that validates URL schemes and destinations, blocks localhost/private ranges unless explicitly allowed, sanitizes monitor names, and accurately documents supported features.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/monitor.sh:12
• Finding: Unrestricted URL Fetching Enables Server-Side Request Forgery and Local Resource Probing<![CDATA[ ## Vulnerability Details **File Location**: `scripts/monitor.sh`, lines 12-28 **Vulnerability Type**: Unrestricted outbound request / SSRF **Risk Level**: High ### Vulnerable Code ```bash add) URL="$2" NAME="${3:-$(echo "$URL" | sed 's|https\?://||;s|[^a-zA-Z0-9]|_|g')}" echo "$URL" > "$MONITOR_DIR/sites/$NAME.url" echo "✅ Monitoring: $NAME ($URL)" ;; list) echo "📋 Monitored sites:" for f in "$MONITOR_DIR"/sites/*.url; do [ -f "$f" ] && echo " - $(basename "$f" .url): $(cat "$f")" done ;; check) CHANGES=0 for f in "$MONITOR_DIR"/sites/*.url; do [ -f "$f" ] || continue NAME=$(basename "$f" .url) URL=$(cat "$f") CURRENT=$(curl -s --max-time 30 "$URL" | md5sum | cut -d' ' -f1) ``` ### Technical Analysis The `add` operation accepts an arbitrary URL and stores it without validating its scheme, destination hostname, resolved IP address, port, or redirect behavior. The `check` operation subsequently supplies this value directly to `curl`. Consequently, a caller can make the process issue requests to destinations that should not be reachable through a website-monitoring feature, including: - Loopback services such as `127.0.0.1` or `localhost`. - Private network services. - Link-local endpoints, including cloud instance metadata services. - Local resources through curl-supported schemes such as `file://`. - Reserved or otherwise sensitive network ranges. The response is hashed rather than displayed, but this does not remove the vulnerability. The script persists the response hash and reports whether it changes, creating a response and change-detection oracle. Request timing and success behavior may also disclose information about internal resources. The use of `curl -s` also suppresses errors, while the absence of `--fail` can cause HTTP error pages to be treated as valid monitored content. ### Attack Path 1. An attacker or untrusted caller invokes the monitor's `ad ...[truncated 1530 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Permit only explicitly supported schemes: ```bash case "$URL" in http://*|https://*) ;; *) echo "Only HTTP and HTTPS URLs are permitted" >&2; exit 1 ;; esac ``` 2. Parse the URL with a robust URL parser rather than regular expressions. 3. Resolve the destination before each request and reject all loopback, private, link-local, multicast, unspecified, and reserved IPv4 and IPv6 ranges. 4. Repeat destination validation after every redirect, or disable redirects unless they are required. This prevents an allowed public URL from redirecting to an internal address. 5. Reject embedded credentials and restrict destination ports to an approved set where possible. 6. Prefer an explicit hostname allowlist when the operational use case permits it. 7. Restrict curl protocols and improve error handling: ```bash curl --proto '=http,https' --fail --show-error --silent \ --max-time 30 -- "$URL" ``` 8. Run network retrieval in a sandbox or network namespace that cannot access loopback services, private networks, metadata endpoints, or sensitive local resources. 9. Do not update the stored baseline when retrieval fails. Record fetch failures separately from valid page changes. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/monitor.sh:12
• Finding: User-Controlled Monitor Names Permit Path Traversal and File Overwrite<![CDATA[ ## Vulnerability Details **File Location**: `scripts/monitor.sh`, lines 12-14 **Vulnerability Type**: Path traversal / unauthorized file write **Risk Level**: Medium ### Vulnerable Code ```bash add) URL="$2" NAME="${3:-$(echo "$URL" | sed 's|https\?://||;s|[^a-zA-Z0-9]|_|g')}" echo "$URL" > "$MONITOR_DIR/sites/$NAME.url" ``` ### Technical Analysis The automatically generated name is sanitized, but an explicitly supplied third argument is assigned to `NAME` without validation. It is then embedded directly into a filesystem path. Shell quoting prevents command substitution or word splitting at the point of use, but it does not prevent filesystem traversal. A name containing `../` can escape `~/.website-monitor/sites`. An absolute name can also alter path resolution semantics. The redirection operator creates or truncates the resolved file and writes the attacker-controlled URL into it. The forced `.url` suffix limits candidate targets to paths ending in `.url`, but it does not prevent creation or overwrite of such files outside the intended state directory. The operation runs with the filesystem privileges of the user executing the skill. Names are later reused when history files are generated, so maliciously placed or manually introduced site entries may also influence paths used by the `check` operation. ### Attack Path 1. The attacker chooses a writable target path whose resulting filename ends in `.url`. 2. The attacker supplies a traversal sequence as the monitor name, for example: ```bash website-monitor.sh add "https://attacker.example/value" "../../target" ``` 3. The script constructs: ```text ~/.website-monitor/sites/../../target.url ``` 4. Filesystem path resolution escapes the intended `sites` directory. 5. The shell creates or truncates the resolved `target.url` file and writes the supplied URL into it. 6. If the target file already exists and is writable, its previous contents are overwritten. Exploita ...[truncated 881 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Validate all supplied names, including explicit names, against a conservative allowlist: ```bash if [[ ! "$NAME" =~ ^[A-Za-z0-9_-]+$ ]]; then echo "Invalid monitor name" >&2 exit 1 fi ``` 2. Explicitly reject: - `/` and backslash path separators. - `.` and `..` path components. - Empty names. - Control characters and newline characters. - Absolute paths. 3. Canonicalize the destination and verify that it remains beneath the canonical sites directory before writing. 4. Avoid silently overwriting existing entries. Use a no-clobber or atomic creation operation unless replacement is explicitly requested: ```bash set -o noclobber printf '%s\n' "$URL" > "$DESTINATION" ``` 5. Create files with restrictive permissions and protect the state directory: ```bash umask 077 mkdir -p -- "$MONITOR_DIR/sites" "$MONITOR_DIR/history" ``` 6. Consider generating internal identifiers independently of user input and storing the display name as data rather than using it as a filename. 7. Apply equivalent validation to every path derived from persisted site names, including history-file paths used by the `check` operation. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (5)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: The declared behavior does not match the implementation: the skill advertises price alerts, screenshot comparison, cron-based automation, and notifications, but the sample code only hashes fetched page content and compares files. This mismatch is dangerous because users may grant trust or deploy the skill under false assumptions, while undeclared network and storage behavior can bypass informed consent and security review.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 90% confidence
• Finding: The skill includes shell-based behavior and an implementation that performs network access and local file writes, but it declares no tool scope or permissions. This is dangerous because it hides the actual execution capabilities from reviewers and users, increasing the chance of unauthorized shell, network, or filesystem use when the skill is invoked.

Vague Triggers

Medium

• Confidence: 92% confidence
• Finding: This markdown file describes the skill in very broad terms like "Monitor websites for changes" and "get alerts when something happens" without specifying how invocation is triggered, what commands activate it, or any exclusion conditions. That ambiguity can cause unintended activation overlap with generic requests about websites, alerts, or monitoring.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill description omits a clear warning that it performs network access and may be used for periodic automated checks. This is dangerous because users may not realize the skill repeatedly contacts external websites and stores state locally, which can create privacy, compliance, and abuse risks if run against sensitive or rate-limited targets.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The script performs outbound HTTP requests to arbitrary user-supplied URLs via curl without any explicit warning, consent prompt, or indication that remote systems will be contacted. In an agent/skill context, this can surprise users, leak network metadata such as IP address and timing to third parties, and create SSRF-like risk if internal or sensitive endpoints are added for monitoring.

Static analysis

No suspicious patterns detected.