Security audit

Siteone Crawler

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent website crawler helper, but it asks the agent to automatically install and run an unverified third-party binary and includes external report upload paths.

Review before installing. Do not allow automatic installation unless you trust the upstream SiteOne Crawler release source, or pin and verify the binary yourself. Keep reports local unless you intentionally enable upload and trust the destination. Avoid passing passwords, cookies, or authorization headers on shared systems, and use stress/load-test or robots/certificate bypass options only on sites you are authorized to test.

A.I.G

Vulnerability Patterns

Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

Findings (1)

T03 · Remote Payload Retrieval and Execution

Error

Location: SKILL.md:30
Finding: Unverified Mutable Binary Download and Execution
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (15)

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 90% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · SKILL.md (reported line 37)May include surrounding context.
&& unzip -o /tmp/siteone-crawler.zip -d /tmp/siteone-crawler
&& mv /tmp/siteone-crawler/siteone-crawler "$INSTALL_DIR/"
&& chmod +x "$INSTALL_DIR/siteone-crawler"
&& rm -rf /tmp/siteone-crawler /tmp/siteone-crawler.zip

text
3. After installation, set `CRAWLER` to the resolved path and verify with `$CRAWLER --version`.

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 85% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · SKILL.md (reported line 37)May include surrounding context.
&& unzip -o /tmp/siteone-crawler.zip -d /tmp/siteone-crawler
&& mv /tmp/siteone-crawler/siteone-crawler "$INSTALL_DIR/"
&& chmod +x "$INSTALL_DIR/siteone-crawler"
&& rm -rf /tmp/siteone-crawler /tmp/siteone-crawler.zip

text
3. After installation, set `CRAWLER` to the resolved path and verify with `$CRAWLER --version`.

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 90% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · SKILL.md (reported line 37)May include surrounding context.
&& unzip -o /tmp/siteone-crawler.zip -d /tmp/siteone-crawler
&& mv /tmp/siteone-crawler/siteone-crawler "$INSTALL_DIR/"
&& chmod +x "$INSTALL_DIR/siteone-crawler"
&& rm -rf /tmp/siteone-crawler /tmp/siteone-crawler.zip

text
3. After installation, set `CRAWLER` to the resolved path and verify with `$CRAWLER --version`.

Chaining Abuse

High

Category: Tool Misuse
Confidence: 75% confidence
Finding: Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.
Content: Scanner excerpt · SKILL.md (reported line 37)May include surrounding context.
&& unzip -o /tmp/siteone-crawler.zip -d /tmp/siteone-crawler
&& mv /tmp/siteone-crawler/siteone-crawler "$INSTALL_DIR/"
&& chmod +x "$INSTALL_DIR/siteone-crawler"
&& rm -rf /tmp/siteone-crawler /tmp/siteone-crawler.zip

text
3. After installation, set `CRAWLER` to the resolved path and verify with `$CRAWLER --version`.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The setup instructions automatically download a release from GitHub and then execute the resulting binary without any integrity verification, pinning, or user-facing warning. This creates a supply-chain risk: a compromised release, MITM in a misconfigured environment, or unexpected asset selection could lead to execution of untrusted code.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 88% confidence
Finding: The setup process contacts the GitHub API to discover the latest release, causing external network transmission without a clear warning. While API access alone is common, in this context it initiates an automated install chain and can leak environment usage patterns or fail open into fetching unreviewed artifacts.
Content: Scanner excerpt · SKILL.md (reported line 31)May include surrounding context.
md
ARCH=$(uname -m) case "$ARCH" in x86_64) ARCH="x64" ;; aarch64|arm64) ARCH="arm64" ;; esac # Get latest release URL from GitHub API RELEASE_URL=$(curl -sL https://api.github.com/repos/janreges/siteone-crawler/releases/latest \ | grep -oP "browser_download_url.*?${OS}-${ARCH}\.zip" | head -1 | sed 's/browser_download_url": "//') curl -sL "$RELEASE_URL" -o /tmp/siteone-crawler.zip \ && unzip -o /tmp/siteone-crawler.zip -d /tmp/siteone-crawler \

External Transmission

Medium

Category: Data Exfiltration
Confidence: 94% confidence
Finding: This command downloads a binary release archive from an external URL and installs it locally. External transmission is especially risky here because it is tied directly to introducing executable code into the environment, amplifying the impact from simple network access to potential code execution.
Content: Scanner excerpt · SKILL.md (reported line 33)May include surrounding context.
md
# Get latest release URL from GitHub API RELEASE_URL=$(curl -sL https://api.github.com/repos/janreges/siteone-crawler/releases/latest \ | grep -oP "browser_download_url.*?${OS}-${ARCH}\.zip" | head -1 | sed 's/browser_download_url": "//') curl -sL "$RELEASE_URL" -o /tmp/siteone-crawler.zip \ && unzip -o /tmp/siteone-crawler.zip -d /tmp/siteone-crawler \ && mv /tmp/siteone-crawler/siteone-crawler "$INSTALL_DIR/" \ && chmod +x "$INSTALL_DIR/siteone-crawler" \

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The documented --upload workflow sends crawl results to an external service, but the skill does not clearly warn that scanned site data and reports may leave the local environment. In an agent setting, this can cause unintended disclosure of internal URLs, metadata, or audit results when users expect a local-only scan.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 85% confidence
Finding: The file documents --http-auth=<user:pass> and elsewhere SMTP and upload password options, but it does not warn that credentials supplied via CLI arguments may be exposed through shell history, process listings, or logs. For a markdown reference that documents sensitive operations, this omission is a meaningful safety gap.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: This markdown file describes --upload and a default external --upload-to URL, which implies report data may be sent off-system. The reference does not include any warning about potential disclosure of crawled content, metadata, or access-controlled findings when upload is enabled.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The script enables an external upload path via the --upload flag, but provides no inline warning, destination disclosure, or confirmation step before transmitting audit artifacts. Because audit reports can contain sensitive URLs, headers, metadata, or internal site structure, this can cause unintended data exfiltration if a user invokes the option without fully understanding its effect.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The script always passes --timezone="Asia/Shanghai" to the crawler, imposing a specific locale-related setting regardless of user preference. This is a natural-language policy concern because locale behavior is fixed without offering a choice or explaining why that region-specific setting is required.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 80% confidence
Finding: The local serving examples start an HTTP listener but do not warn that exported content becomes accessible over a network interface depending on the tool's bind behavior. This may expose crawled or exported data to other local users or nearby systems if the service is not bound to localhost.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 78% confidence
Finding: --accept-invalid-certs weakens transport security, and --ignore-robots-txt changes expected crawl behavior, yet the reference presents them without any cautionary note. Even in parameter documentation, users should be warned when an option can reduce security or bypass standard site restrictions.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The script hard-codes --timezone="Asia/Shanghai", imposing a specific locale-related setting for all users. This can violate language/locale neutrality expectations because no opt-in, override, or justification is provided in the script comments or interface.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.