Security audit

Link Checker

Security checks for vulnerabilities and agentic risk

Overview

This link checker is mostly coherent, but needs Review because it can make unrestricted host-network requests from scanned content and has an unsafe persistent config path.

Review before installing in environments with access to internal services or sensitive documents. Avoid scanning untrusted files, avoid checking private or token-bearing URLs unless intended, and clear ~/.link-checker when URL history should not persist. Do not let untrusted text drive config changes.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Error

Location: scripts/script.sh:60
Finding: Unrestricted URL Requests Enable Server-Side Request Forgery
Content: View full analysis
/dev/null) || code="ERROR" if [ "$code" = "000" ]; then code="TIMEOUT" fi # If we got a valid response (not timeout/error), stop retrying if [ "$code" != "TIMEOUT" ] && [ "$code" != "ERROR" ]; then break fi attempt=$((attempt + 1)) done echo "$code" } ``` An example input path is: ```bash cmd_check() { local url="${1:?Usage: link-checker check }" echo "Checking: ${url}" local code code=$(_check_url "$url") local icon icon=$(_status_icon "$code") local label label=$(_status_label "$code") echo " ${icon} ${code} — ${label}" _record "$url" "$code" } ``` ### Technical Analysis The script passes user-supplied or document-extracted URLs directly to `curl` without validating the URL scheme, resolved destination address, port, or redirect destination. The `-L` option follows redirects automatically, also without applying destination restrictions after each redirect. Consequently, the URL checker can be made to initiate requests from the host running the Skill to destinations that an external attacker might not otherwise be able t ...[truncated 2047 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/script.sh:45
Finding: Unvalidated Numeric Configuration Can Trigger Bash Arithmetic Command Injection
Content: View full analysis
/dev/null; then sed -i "s|^${key}=.*|${key}=${val}|" "$CONFIG_FILE" else echo "${key}=${val}" >> "$CONFIG_FILE" fi echo " Set ${key} = ${val}" } ``` The stored values are subsequently used in numeric and arithmetic contexts: ```bash _check_url() { local url="$1" local timeout timeout=$(_get_config "timeout" "$DEFAULT_TIMEOUT") local retries retries=$(_get_config "retries" "$DEFAULT_RETRIES") local ua ua=$(_get_config "user_agent" "$DEFAULT_USER_AGENT") local attempt=0 local code="" while [ $attempt -le "$retries" ]; do code=$(curl -sI -o /dev/null -w "%{http_code}" \ --connect-timeout "$timeout" \ --max-time "$((timeout * 2))" \ -A "$ua" \ -L "$url" 2>/dev/null) || code="ERROR" ``` The command dispatcher validates the key name but not its value: ```bash set) local key="${2:?Usage: link-checker config set }" local val="${3:?Usage: link-checker config set }" case "$key" in timeout|retries|user_agent) _set_config "$key" "$val" ;; *) echo "Unknown config key: ${key}" echo "Valid keys: timeout, retries, user_agent" return 1 ;; esac ``` ### Technical Analysis The `timeout` and `retries` settings are intended to be decimal integers, but `_set_config` accepts arbitrary strings. The va ...[truncated 2420 chars]
Remediation: View remediation
&2 return 1 fi ``` 3. Enforce reasonable ranges, such as: - `timeout`: 1–300 seconds - `retries`: 0–10 4. Reject signs, whitespace, arithmetic operators, variable references, command substitutions, shell metacharacters, and leading formats that could be interpreted unexpectedly. 5. Perform arithmetic only after successful validation: ```bash timeout_num=$((10#$timeout)) retries_num=$((10#$retries)) max_time=$((timeout_num * 2)) ``` 6. Use the validated numeric variables consistently in comparisons and `curl` arguments. 7. Avoid constructing a `sed` program with an unescaped value. Rewrite the small configuration file using validated values, or escape all replacement metacharacters before invoking `sed`. 8. Create the data directory and configuration file with restrictive permissions, such as directory mode `0700` and file mode `0600`, to reduce tampering by other local users. 9. If configuration commands can be generated from untrusted natural-language input, require confirmation or enforce a fixed typed interface before changing persistent settings. ]]>

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (4)

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 90% confidence
Finding: The skill clearly describes shell-backed behavior using curl, grep, sort, and awk, but it does not declare any explicit tool scope such as permissions or allowed-tools. That creates an authorization and review gap: consumers may invoke a network-capable, shell-executing skill without a machine-readable restriction boundary, increasing the chance of unintended command execution or outbound requests in environments that rely on manifest scoping.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill persistently stores checked URLs, reports, and history under ~/.link-checker/, but the description does not present this as an explicit privacy warning. URLs often contain sensitive query strings, internal hostnames, tokens, document locations, or customer data, so silent retention can expose private information to other local users, backups, logs, or later exports.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The script issues outbound requests to arbitrary user-supplied URLs and follows redirects automatically, which can probe internal services, hit sensitive endpoints, or leak browsing/audit targets into local history without explicit warning. In agent or automation contexts, this creates SSRF-like risk and privacy exposure because untrusted content scanned from files can trigger network access beyond what a user may expect.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Low

Category: Not specified by scanner
Confidence: 86% confidence
Finding: The manifest describes a link-auditing tool focused on crawling pages and detecting broken links, redirects, and HTTP errors. This script additionally creates a persistent local data store for configuration and logs, then provides reporting/history/export features that retain and repurpose checked URLs over time, which is broader behavior than the stated checking/auditing function.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.