T09 · Insecure Skill Coding Practices
Error
- Location
scripts/run_web_fetch.mjs:170- Finding
API Credential Disclosure Through an Unrestricted Endpoint Override
- Content
View full analysis
- Remediation
View remediation
Security audit
Felo Web Fetch
Security checks for vulnerabilities and agentic risk
Overview
The skill performs its stated Felo web-fetch function, but it has review-worthy risks around third-party URL/content handling, an unrestricted API endpoint override that can expose the API key, and an unpinned global CLI install path.
Install only if you are comfortable sending requested URLs, selectors, and fetched page content to Felo. Do not use it for private intranet pages, authenticated links, signed URLs, secrets, regulated data, or confidential content unless that sharing is approved. Keep `FELO_API_BASE` unset unless you control and trust the endpoint, protect and rotate `FELO_API_KEY` if exposed, and prefer the bundled script or a pinned reviewed CLI version over an unpinned global npm install.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)
T08 · Insecure Dependencies
Warning
- Location
README.md:47- Finding
Unpinned Global Installation of a Third-Party CLI Package
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (7)
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The README instructs users to send arbitrary URLs to the Felo Web Extract API but does not disclose that both the target URL and the fetched content are transmitted to a third-party service. This creates a privacy and data-handling risk because users may submit internal, sensitive, or copyrighted pages without realizing the content leaves their environment.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 91% confidence
- Finding
The skill documents use of environment variables and outbound network access but does not declare an explicit tool scope such as permissions or allowed-tools. This can lead to overbroad execution in agent environments, making it harder to enforce least privilege and easier for the skill to access secrets or make unintended external requests.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The skill description tells users to fetch webpage content through the Felo Web Extract API but does not warn that requested URLs and fetched page data are transmitted to a third-party service. This creates a privacy and data-handling risk because users may provide sensitive internal URLs or confidential content without informed consent.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 83% confidence
- Finding
The documented curl/API flow explicitly sends user-supplied URLs and extracted content to an external endpoint operated by Felo. While this is the intended function of the skill, it is still a real data egress vector and can expose sensitive URLs, tokens embedded in URLs, or private page contents to a third party if users are not constrained or warned.
- Content
node felo-web-fetch/scripts/run_web_fetch.mjs --url "https://example.com" --target-selector "#content" --format text
text ### Option B: Call API with curl ```bash curl -X POST "https://openapi.felo.ai/v2/web/extract" \
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The script sends a user-supplied URL plus extraction options to the external Felo API endpoint, which means any private, internal, signed, or sensitive URL entered by a user is disclosed to a third party. In an agent/skill context, this is dangerous because users may assume the tool fetches directly and locally, while the implementation actually forwards request metadata and target URLs off-platform without any explicit warning or consent step.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
The README shows how to place an API key in an environment variable but gives no guidance on protecting that credential from shell history exposure, accidental logging, screenshots, or committing it into scripts and config files. While environment variables are a common practice, omitting basic secret-handling guidance increases the chance of credential leakage by inexperienced users.
- Content
Vague Triggers
Low
- Category
- Not specified by scanner
- Confidence
- 82% confidence
- Finding
The trigger keywords are broad enough that the skill could be invoked in routine browsing, summarization, or link-processing contexts without the user explicitly intending third-party extraction. In this skill's context, unintended invocation is more concerning because it can cause external transmission of URLs and page contents, compounding the privacy issue.
- Content
Static analysis
Detected: suspicious.env_credential_access
Environment variable access combined with network send.
Critical
- Code
- suspicious.env_credential_access
- Location
- scripts/run_web_fetch.mjs:164