Security audit

Car Specs Crawler

Security checks for vulnerabilities and agentic risk

Overview

The skill is a legitimate car-spec crawler, but it needs Review because its crawler can follow scraped or redirected URLs outside the stated auto sites.

Install only if you are comfortable with a crawler making live web requests. Prefer running it in a restricted environment, avoid sensitive networks, review output paths before using --output, and pin dependencies before installing missing packages.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/fetch-car-specs.py:34
Finding: Unvalidated Scraped URLs Allow Unintended Outbound Requests
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Note

Location: scripts/fetch-car-specs.py:13
Finding: Dependency Installation Guidance Uses Unpinned Packages
Content: View full analysis
Remediation: View remediation
` and `lxml==`. 2. Generate and record cryptographic hashes for all direct and transitive dependencies. 3. Require hash verification during installation, such as `python -m pip install --require-hashes -r requirements.txt`. 4. Use a trusted, explicitly configured package index or an internally controlled artifact repository. 5. Update `SKILL.md` and the import-error message to reference the reviewed requirements or lock file rather than suggesting an unconstrained installation command. 6. Perform regular dependency vulnerability scans and controlled upgrades, regenerating hashes only after review and testing. 7. Install dependencies in an isolated virtual environment with only the permissions needed to run the crawler. ]]>

SkillSpector

Vulnerability Patterns

MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (4)

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 95% confidence
Finding: The skill documents network access and local file output behavior but does not declare any explicit tool scope or permissions boundaries. In an agent environment, this can lead to overbroad execution privileges, making it easier for the skill to perform unintended network requests or write files beyond what a user reasonably expects.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 87% confidence
Finding: The skill instructs users to save crawler output to a local file but provides no warning about overwriting existing files or modifying local data. While the example itself is not inherently malicious, absent safeguards can cause accidental data loss or unexpected writes when the output path is user-controlled or reused.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The module docstring explicitly states that the crawler fetches specifications from Chinese auto websites, and the rest of the script is built around Chinese-language sources and output labels. This imposes a specific locale/language context without any opt-in or alternative, which matches the policy concern for forced language or locale behavior.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Low

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The manifest frames the skill as a crawler for collecting vehicle configuration data from automotive websites. In addition to fetching and formatting results, the code accepts an output path and writes JSON results to disk, which is a behavior beyond the manifest's stated 'fetch' scope rather than an obvious requirement of crawling itself.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.