Security audit

Debunk（事实核查）

Security checks for vulnerabilities and agentic risk

Overview

This fact-checking skill is mostly coherent, but its local browser URL fetcher has under-scoped SSRF protections and its social-reply guidance includes covert or evasive persuasion patterns.

Install only if you are comfortable with a skill that may launch a local browser against user-provided URLs. Avoid using it on untrusted links in cloud, corporate, or private-network environments unless network egress blocks metadata and internal addresses. Treat its social reply templates carefully and prefer transparent corrections that do not hide known falsehoods.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Error

Location: scripts/fetch-url.js:14
Finding: Incomplete SSRF Protection Allows Access to Internal and Cloud Metadata Services
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (10)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: The code does not implement factual verification, rumor debunking, evidence comparison, or response generation. Its actual role is limited to fetching and extracting text from a public web page using Playwright, with anti-scraping-friendly behavior and SSRF protections. While URL fetching could be a supporting component of a fact-checking system, this chunk by itself materially differs from the declared end-user purpose because it only retrieves webpage text and does not perform the claimed fact-checking tasks or support the full declared input modalities.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The manifest description is entirely Chinese and defines the skill as a fact-checking tool without stating that Chinese is optional or limited to a region-specific use case. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The fixed output format requires Chinese field labels such as '论点', '结论', '查证', and '真相', which constrains responses to a specific language. The file does not offer a language choice or state a justified locale limitation.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The skill goes beyond neutral fact-checking and explicitly instructs generation of persuasive social replies, including modes that can flatter, evade, or soften correction. That creates a misuse path where the tool can help users manipulate recipients or obscure falsehoods instead of clearly communicating verified facts.
Content: No source excerpt is available for this finding.

Ssd 4

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The workflow explicitly teaches the model to build rapport and then covertly steer the recipient 'without obvious correction,' which is a social-engineering pattern. Even in a fact-checking context, instructing hidden persuasion rather than transparent correction can facilitate deceptive interpersonal influence and misuse in sensitive conversations.
Content: No source excerpt is available for this finding.

Ssd 4

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The 'flattering' mode specifically tells the model to praise the sharer while obscuring or skipping false portions, which directly supports deceptive communication. In context, this undermines the stated debunking purpose and can be exploited to launder misinformation through socially optimized replies.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 70% confidence
Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The code hard-codes locale: 'zh-CN' for all browsing sessions, which imposes a specific language/locale choice on users. Under the policy, locale constraints should either be optional, user-selectable, or clearly justified as region-specific behavior.
Content: No source excerpt is available for this finding.

Unpinned Dependencies

Low

Category: Supply Chain
Confidence: 93% confidence
Finding: The manifest uses a caret range for Playwright, which does not fully pin the resolved package version and can allow unexpected dependency changes across installs. This weakens build reproducibility and can expose the project to newly introduced vulnerable or malicious releases in the allowed semver range.
Content: Scanner excerpt · package.json (reported line 3)May include surrounding context.
json
{ "devDependencies": { "playwright": "^1.59.1" } }

Unverifiable Dependency: playwright has 1 known advisory(ies) (CVE-2025-59288 (Playwright downloads and installs browsers without verifying the authenticity of)), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

Category: Supply Chain
Confidence: 84% confidence
Finding: The project depends on Playwright, which has a known advisory related to downloading browser binaries without authenticity verification, and the manifest does not pin the exact version. Because the actual installed version cannot be determined from this file alone, there is a credible supply-chain risk that an affected release could be installed or that vulnerable behavior remains present.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.