WhatsLink

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 9:25 AM UTC
• Version: 0.1.1

Overview

This skill is a disclosed WhatsLink metadata helper that sends only user-provided public URLs to an external lookup service when invoked.

Install only if you are comfortable sending the links you check to WhatsLink or to any endpoint you explicitly configure. Use it only for public, non-sensitive URLs, and do not submit signed links, internal resources, document-sharing URLs, or links containing tokens, API keys, sessions, or credentials.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/whatslink_query.py:45

Finding

Potentially Sensitive Target URLs Can Be Disclosed to Arbitrary Network Endpoints

Content

View full analysis

Vulnerability Details

File Location: scripts/whatslink_query.py:45-51, 160-169
Vulnerability Type: Unrestricted transmission of user-supplied URLs to configurable external endpoints
Risk Level: Medium

Complete Code Snippet

python

def fetch_metadata(endpoint: str, target_url: str, timeout: float, user_agent: str | None) -> dict[str, Any]:
    query_url = build_query_url(endpoint, target_url)
    headers = {"User-Agent": user_agent or DEFAULT_UA, "Accept": "application/json"}
    request = Request(query_url, headers=headers)

    try:
        with urlopen(request, timeout=timeout) as response:

python

parser.add_argument("url", help="要检查的公开 URL。不要传入私密、带 token 或内网链接。")
parser.add_argument("--json", action="store_true", help="输出 WhatsLink 原始 JSON 响应。")
parser.add_argument("--no-screenshots", action="store_true", help="在人类可读摘要中隐藏截图 URL。")
parser.add_argument("--max-screenshots", type=non_negative_int, default=None, help="摘要中最多展示的截图 URL 数量（默认：全部）。传 0 表示不列出。")
parser.add_argument("--timeout", type=positive_timeout, default=20.0, help="请求超时时间，单位秒（默认：20）。")
parser.add_argument("--endpoint", default=DEFAULT_ENDPOINT, help=f"API endpoint (default: {DEFAULT_ENDPOINT}).")
parser.add_argument("--user-agent", default=None, help="可选的自定义 User-Agent。")
return parser.parse_args(argv)


def main(argv: list[str] | None = None) -> int:
    args = parse_args(argv or sys.argv[1:])
    try:
        data = fetch_metadata(args.endpoint, args.url, args.timeout, args.user_agent)

Technical Analysis

The script embeds the complete user-supplied target URL in the url query parameter of an outbound request. This transmission is necessary for the declared metadata lookup when the target is a public, non-sensitive link. However, the restrictions documented in SKILL.md and the CLI help are advisory only.

The code does not reject URLs containing user information, signed query parameters, API keys, session identifiers, or other secrets. It also does no ...[truncated 1793 chars]

Remediation

View remediation

Remediation Suggestions

1. Restrict the default network destination to an explicit allowlist containing only the documented WhatsLink HTTPS endpoint.
2. Require a conspicuous opt-in flag for alternative endpoints, and reject non-HTTPS endpoints unless an additional testing-only override is supplied.
3. Validate target URLs before transmission:
   • Permit only http and https schemes.
   • Reject embedded usernames or passwords.
   • Reject localhost, loopback, link-local, private-network, and internal hostnames.
   • Reject or require explicit confirmation for sensitive query keys such as token, access_token, api_key, key, signature, sig, session, and auth.
4. Disable redirects or validate every redirect destination against the same HTTPS allowlist before forwarding the request.
5. Warn the user immediately before external transmission and identify the exact destination service.
6. Avoid printing complete sensitive target URLs in output or error paths; redact credentials and sensitive query values.
7. Keep the existing documentation warnings, but enforce them in code rather than relying solely on caller behavior.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Lp1

High

• Category: MCP Least Privilege
• Confidence: 92% confidence

Finding

This script performs outbound network requests to an external service and also allows the caller to override the API endpoint, so it has effective network capability beyond a purely local metadata formatter. In an agent/skill context, undeclared network access is a real security concern because it can transmit user-supplied URLs and potentially be redirected to arbitrary destinations, creating SSRF/privacy risks if the surrounding platform does not gate or disclose network permissions.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

This code contains multiple natural-language strings shown to users in Chinese, including the summary output and most argument descriptions. The file does not provide any user opt-in, language selection, or justification that the tool is intentionally region-specific, which violates the language/locale policy criteria.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.