T05 · Unauthorized Access and Privilege Escalation
Error
- Location
scripts/download_ir_pdf.py:255- Finding
Arbitrary URL Download Enables Server-Side Request Forgery
- Content
View full analysis
- Remediation
View remediation
Security audit
IR PDF Downloader
Security checks for vulnerabilities and agentic risk
Overview
This skill is mostly aligned with finding and downloading IR PDFs, but it gives the agent broad outbound download ability without enough network safeguards.
Install only if you are comfortable with the agent making outbound web requests and writing downloaded PDFs locally. Use it with known public IR or SEC URLs, avoid untrusted URL lists, and prefer running it in a network-restricted environment until URL validation, redirect validation, private-address blocking, and download size limits are added.
Vulnerability Patterns
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)
T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
scripts/find_ir_pdf.py:178- Finding
User-Controlled Domain Probing Permits Blind Internal Network Requests
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/download_ir_pdf.py:262- Finding
Unbounded Response Buffering Enables Memory Exhaustion
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (7)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
The code substantially aligns with much of the description: it can download known PDF URLs, query the Wayback Machine for archived PDF links, and handle batch PDF downloads relevant to IR sites. It does not perform SEC/XBRL analysis, which is consistent with the declared limitation. However, the description claims the skill can 'find a PDF URL' and 'probe common IR PDF paths,' but the supplied code contains no crawler, no HTML parsing, and no path-probing logic beyond accepting explicit URLs or searching Wayback CDX for '*.pdf' under a domain. Its search behavior is broader and more generic than the declared IR static-path probing: it searches all PDF URLs under a domain pattern and can batch-download them. That makes the declared description materially inaccurate/incomplete about the actual implemented discovery method.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 88% confidence
- Finding
The code substantially matches the discovery portion of the description: it probes common IR PDF paths, searches Wayback for archived PDF links, and avoids structured financial/XBRL analysis. However, there are two material gaps. First, the declared purpose says the skill can 'discover and download' static PDFs and 'download a known static PDF document,' but this script never downloads PDF content; it only finds URLs, performs HEAD/GET requests for discovery, and optionally writes JSON results. Second, it uses SEC EDGAR as a PDF-discovery source, which is adjacent to the declared scope but not clearly represented by 'IR sites' alone. Because the primary behavior is close but the claimed download capability is absent and the resource scope extends to EDGAR, this is a moderate mismatch.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 90% confidence
- Finding
The skill declares commands that read local reference files, write downloaded PDFs, and perform network access, but it does not define any explicit tool scope such as permissions or allowed-tools. In an agent environment, missing scope boundaries can let the skill run with broader capabilities than users or orchestrators expect, increasing the chance of unintended filesystem or outbound network access.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The alias "li" is overly broad and can match many unrelated user queries, names, or tokens, causing the skill to resolve the wrong issuer. In this skill, that can misdirect PDF discovery/downloads to Li Auto's IR site, leading to incorrect document retrieval and unreliable results rather than direct code execution or system compromise.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The manifest scopes this skill to discovering and downloading static PDF files from Investor Relations sites, especially annual reports and quarterly results. Here the code searches for all PDF URLs under a domain using broad wildcard patterns and later downloads all matches, without restricting results to IR-specific paths or report-like documents, which gives it a broader archived-PDF harvesting capability than the stated purpose justifies.
- Content
Intent-Code Divergence
Low
- Category
- Not specified by scanner
- Confidence
- 86% confidence
- Finding
The top-level docstring frames the tool as operating on Investor Relations websites, but the CLI and Wayback search path accept any domain string that matches a simple hostname regex and then enumerate/download PDFs from it. This is an active documentation/code divergence because the documentation narrows intended use to IR sites while the code does not enforce that constraint.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The default request headers force the locale to "en-US,en;q=0.9" for all outbound HTTP requests. This is a natural-language locale constraint with no user opt-in, configurability, or documented region-specific justification, which can violate language/locale policy expectations.
- Content
Static analysis
No suspicious patterns detected.