网页内容获取免费版

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:28 AM UTC
• Version: 1.0.0

Overview

This skill fetches webpages through third-party Markdown services, but it requests broader local file/tool access than it needs and gives under-scoped guidance around blocked or protected sites.

Review this skill carefully before installing. Use it only for public URLs you are authorized to retrieve, avoid URLs with tokens or private/internal content, and prefer a version that limits permissions to the minimum needed for HTTP fetching and clearly discloses third-party data handling.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: SKILL.md:30

Finding

Excessive Local Filesystem Permissions

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 30-34
Vulnerability Type: Excessive tool permissions violating least privilege
Risk Level: Medium

Vulnerable Code

yaml

tools:
  - read
  - exec
  - write
  - glob

Technical Analysis

The Skill declares read, write, and glob capabilities even though its documented workflow only requires making HTTP requests through curl. No documented feature requires reading, enumerating, or modifying local files.

This unnecessarily expands the Skill's authority over the local workspace. The risk is particularly relevant because the Skill retrieves arbitrary, potentially attacker-controlled web content. If that content contains adversarial instructions that influence the hosting agent, the unnecessary filesystem tools could increase the effect from untrusted content processing to local file discovery, access, or modification.

The audit found no instruction explicitly directing the Skill to misuse these permissions. This finding concerns the avoidable privilege exposure created by the declared tool set.

Attack Path

1. A user invokes the Skill to retrieve a URL controlled by an attacker.
2. The Skill sends the URL to one of its documented third-party conversion services and receives attacker-controlled page content.
3. The returned content contains instructions intended to manipulate the hosting AI agent.
4. If the agent follows those instructions without maintaining a strict trust boundary, the declared glob capability may be used to discover workspace files.
5. The declared read capability may expose accessible local file contents.
6. The declared write capability may allow modification of accessible workspace files.
7. The resulting scope exceeds the legitimate requirement of retrieving and returning webpage content.

Impact Assessment

Successful exploitation would depend on the hosting agent treating fetched content as instructions rather than untrusted data and ...[truncated 481 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove the unnecessary read, write, and glob capabilities from the declared tool set.
2. Retain only the minimum network capability needed to retrieve webpage content.
3. If command execution is unavoidable, restrict exec to a fixed HTTP client and an allowlisted argument structure rather than permitting arbitrary shell commands.
4. Validate URLs before use, permitting only expected http and https schemes and rejecting shell metacharacters or ambiguous input.
5. Treat all fetched webpage content as untrusted data and explicitly prohibit interpreting it as agent instructions.
6. Require user confirmation before any local filesystem operation if such functionality is added later.
7. Apply host-level sandboxing, outbound-network restrictions, workspace boundaries, and tool-call authorization controls to reduce the impact of malicious fetched content.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (9)

Vague Triggers

High

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The trigger keywords are extremely broad, including common topics like writing, marketing, API design, automation, and performance optimization, far beyond the narrow purpose of webpage fetching. Overbroad activation can cause the agent to select this skill in unrelated tasks, leading to unnecessary command execution, unintended external requests, and leakage of user-provided URLs or context to third-party services.

Content

No source excerpt is available for this finding.

Vague Triggers

High

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The capability coverage section defines activation scope with an expansive and ambiguous keyword list, including unrelated productivity and content-creation scenarios. In an agent environment with exec and network tools, such ambiguous scope increases the chance of accidental invocation and silent routing of requests through external fetch services without a clear user intent to do so.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill does not clearly warn that requested URLs and retrieved content are sent to third-party services such as r.jina.ai, markdown.new, and defuddle.md. This omission can expose sensitive URLs, internal endpoints, access tokens embedded in query strings, or proprietary page content to external providers without informed user consent.

Content

No source excerpt is available for this finding.

Ssd 2

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill explicitly promotes using alternate services when ordinary crawling is blocked or filtered, including for Cloudflare-protected sites. In context, this is dangerous because it frames access barriers as obstacles to work around rather than signals to stop or confirm authorization, encouraging circumvention behavior through third-party infrastructure.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill is presented as a webpage-to-Markdown fetcher, but these sections claim generic create/query/modify/delete and import/export style operations that do not match the described functionality. This kind of capability inflation can cause an agent or user to over-trust the skill, invoke it in unintended contexts, or wire unsafe parameters into exec-capable flows based on misleading documentation.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

The examples encourage use on filtered or Cloudflare-protected sites but do not warn that doing so may violate site terms, publisher restrictions, or other access-control expectations. This normalizes potentially unauthorized retrieval behavior and may lead users or agents to process content they should not access through alternate fetch paths.

Content

No source excerpt is available for this finding.

Ssd 2

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The usage examples provide concrete commands for obtaining content after standard retrieval is blocked, using fallback services as a workaround. Practical step-by-step examples materially increase risk because they lower the barrier to executing access-circumvention behavior and make misuse straightforward in an agent with exec capability.

Content

No source excerpt is available for this finding.

Ssd 2

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The best-practice guidance normalizes retrying with alternate services after standard fetching is blocked, reinforcing a pattern of continuing after an access barrier is encountered. In this skill's context, that guidance increases the likelihood of repeated unauthorized requests and externalization of content retrieval to third parties.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The display name, summary, and primary documentation are presented in Chinese, while the skill is described as usable across multiple agent platforms and environments. There is no indication that the user can choose another language or that the Chinese-only presentation is a justified locale constraint.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.