Security audit
Security checks for vulnerabilities and agentic risk
Review is needed because folder sharing can expose files outside your selection, and update instructions can run new code without approval.
Before uploading, review an explicit file list, exclude secrets and repository history, and reject symlinks that leave the selected folder. Confirm that Webly links provide the access you intend; expiry and random addresses do not make sensitive files private. Require approval for updates and choose the narrowest account access needed. Both bundled files were reviewed; remote API enforcement and future downloaded code were not verified.
scripts/webly.mjsFolder sharing follows attacker-supplied symlinks outside the authorized folder
Readable credentials, private documents, or other files outside the selected folder can be published through Webly's file-sharing links without separate approval.
Referenced artifact was not completely inspected
The helper that does every deterministic step is `scripts/webly.mjs` in this
The folder-sharing instructions explicitly preserve hidden files and tell the agent never to drop them, without requiring a sensitive-file review. This can publish .env credentials, private configuration, repository history, or other confidential material through file links and downloadable archives; unguessable links and short retention do not prevent disclosure to link holders.
The update recommendation includes piping a mutable remote shell script directly into bash without release pinning or independent integrity verification. If the installer delivery channel is compromised, following this recommendation executes attacker-controlled code with the user's privileges; this file does not execute it automatically, which reduces immediate exposure.
const plugin = realpathSync(fileURLToPath(import.meta.url)).includes(`${sep}plugins${sep}`);
return { installed: VERSION, latest, command: plugin
? 'claude plugin update webly@webly (then restart Claude Code or run /reload-plugins)'
: 'npx skills update webly -g (no npm: curl -fsSL https://webly.ai/install.sh | bash)' };
} catch { return null; }
}
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
}
/**
* A fresh access token for the saved sign-in. Refreshes (saving the rotated refresh token) when it is
* due or when `stale` was just refused, under a lock, reusing what another process refreshed meanwhile.
*/
async function accessToken(base, { stale } = {}) {
Skill reads from agent configuration directories (.claude/, .codex/, .gemini/). These directories may contain API keys, personal settings, and other credentials that the skill has no legitimate need to access.
if (argument === 'codex') {
if (!setup.codex.configured) {
const add = run('codex', ['mcp', 'add', 'webly', '--url', mcpUrl]);
if (add.missing) throw new Error('The codex CLI is not on PATH. Add to ~/.codex/config.toml:\n[mcp_servers.webly]\nurl = "' + mcpUrl + '"');
if (!add.ok) throw new Error(`codex mcp add failed:\n${add.output}`);
}
return print({ connected: 'codex', mcpUrl, pending: hasToken ? 'claim' : null,
Without declared permissions the skill's intent is opaque and cannot be validated.
Triggers such as 'send these files' do not establish consent to upload the files to a third-party hosting service and make them accessible by link. The sharing workflow asks about link presentation rather than confirming the hosting destination and access model, potentially turning an ambiguous request into unintended external disclosure.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
metadata:
publisher: Webly
homepage: https://webly.ai
docs: https://api.webly.ai/docs
api-contract: https://api.webly.ai/llms.txt
mcp-server: https://api.webly.ai/v1/mcp
---
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
publisher: Webly
homepage: https://webly.ai
docs: https://api.webly.ai/docs
api-contract: https://api.webly.ai/llms.txt
mcp-server: https://api.webly.ai/v1/mcp
---
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
homepage: https://webly.ai
docs: https://api.webly.ai/docs
api-contract: https://api.webly.ai/llms.txt
mcp-server: https://api.webly.ai/v1/mcp
---
# Webly
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
for them.
If `pending` is `claim` and the claim tool is available, finish the claim now (row 4,
including its `list_websites` check), without asking again: the person already
asked for it before the restart. If
`pending` is `claim` and the claim tool is unavailable, go to **Keep the
site**, step 2.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Other hosts: follow https://webly.ai/agent.md, Phase 2.
- **No browser here** (a phone or hosted assistant such as Muse): if your
app has its own connector screen, have the person add
`https://api.webly.ai/v1/mcp` there and sign in through it. If it only
takes an API key: they open **Connect agent** in the dashboard and paste
its prompt; you open its `/connect/<code>` link and the answer contains
your key, once: save it in your secure credentials, never the chat
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
Although this is an updater recommendation rather than an MCP server declaration, it recommends executing the skills package through npx without an explicit version. Following the recommendation can execute newly resolved package code with the agent user's privileges if the package distribution is compromised; the risk is conditional because this function only returns the command and the agent is told to offer it to the user.
The login documentation at L0619–L0620 explicitly states that only the refresh token is kept. L0660 instead passes both the refresh token and access token to saveLogin, which writes them to disk at L0603; L0700 also persists access tokens after refresh. This contradicts the documented credential-retention policy, although the file is created with restrictive permissions.