Security audit

Web Fetch as Markdown

Security checks for vulnerabilities and agentic risk

Overview

This skill has a coherent markdown-fetching purpose, but it can automatically send full user URLs to third-party services and route around a platform domain-safety warning.

Review carefully before installing. It may be useful for converting public web pages to Markdown, but avoid using it with private links, reset links, pre-signed URLs, internal resources, or URLs containing tokens or identifiers. The skill should ask before sending any URL to an external conversion service and should not bypass a platform safety warning through a proxy-style fallback.

A.I.G

Vulnerability Patterns

Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

other

Warning

Location: SKILL.md:12
Finding: Automatic Disclosure of User-Supplied URLs to Third-Party Conversion Services
Content: View full analysis
`**: Jina AI's official Reader API. Excellent for parsing clean markdown from complex pages when the primary service fails. 3. **Fallback 2 (Requires Consent) — `https://markdownforagents.com/r?url=`**: General-purpose converter returning Markdown with YAML frontmatter. Only use when primary services are unreachable, and after informing the user. ``` ```markdown - **Data Transparency:** Be aware that sending URLs to conversion services means the URL path (and potentially any non-authenticated content on that page) is exposed to the API provider. Avoid fetching pages known to contain sensitive authentication tokens in the URL. ``` ### Technical Analysis The Skill directs the Agent to submit complete target URLs to third-party conversion providers. A complete URL can contain sensitive information in its path or query string, including: - Authentication or password-reset tokens - Pre-signed object-storage parameters - Private document identifiers - Usernames, email addresses, and search terms - Session or API credentials embedded in query parameters - Secret capability URLs that grant access to otherwise private content Only the third fallback explicitly requires user consent. The primary Cloudflare service and the Jina fallback are used automatically, despite receiving substantially the same potentially sensitive information. The instruction to avo ...[truncated 1862 chars]
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Warning

Location: SKILL.md:25
Finding: Proxy Fallback Can Circumvent Built-In Domain Safety Restrictions
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The trigger phrases are broad enough to match common requests such as 'look up', 'help me check', or 'open this link', which can cause the skill to activate in situations the user did not specifically intend. In this skill, unintended activation can send user-supplied URLs to third-party conversion services, creating privacy and data-handling risk even though the skill itself includes some safety guidance.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 78% confidence
Finding: The trigger section hard-codes Chinese and English user intents as the recognized activation phrases, which can imply a language-specific invocation policy without stating whether other languages are supported. There is no explicit user choice or documented justification for limiting triggers to these locales.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.