T09 · Insecure Skill Coding Practices
Error
- Location
scripts/crawl_website.py:18- Finding
Server-Side Request Forgery Through Unrestricted Website Crawling
- Content
View full analysis
- Remediation
View remediation
Security audit
Content Strategy Analyzer
Security checks for vulnerabilities and agentic risk
Overview
This skill does useful website-analysis support work, but it gives the agent an unrestricted URL fetcher and can generate Excel files containing unsafe formula-like content.
Review this skill before installing in environments with access to internal networks, cloud metadata services, or sensitive local files. Only run the crawler on trusted public URLs, consider adding private-network and redirect blocking, and sanitize Excel cell values so generated workbooks cannot contain formulas from untrusted content.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/generate_excel.py:136- Finding
Spreadsheet Formula Injection in Generated Excel Workbooks
- Content
View full analysis
- Remediation
View remediation
T08 · Insecure Dependencies
Note
- Location
SKILL.md:18- Finding
Unpinned Third-Party Dependency Installation
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (6)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
The declared description presents this skill as an analysis tool that produces strategic marketing outputs: multi-language content strategy, keyword research, competitor analysis, and SEO planning. The code does not perform those tasks. It simply requests one URL, parses the HTML with BeautifulSoup, extracts the page title, meta description, and external HTTP links, and writes the result to a JSON file. Although crawling a website could be a supporting step for later analysis, the supplied code chunk itself lacks any logic for keyword extraction, competitor identification, language/country targeting, industry analysis, or strategic recommendations. Therefore the actual behavior is materially narrower and different from the declared purpose.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The declared purpose suggests an analysis skill that takes a website URL and produces strategic SEO/content insights such as keyword research, competitor analysis, and multilingual content planning. However, the supplied code only formats provided analysis data into an Excel workbook using openpyxl. It reads JSON from a local file, creates three sheets, localizes labels for several languages, and saves the workbook. There is no network access, no URL processing, no crawling or parsing of websites, no search/SEO analysis, and no competitor discovery or research logic. While the workbook structure aligns with the output themes mentioned in the description, the actual implemented behavior is materially different: it is an export/report-generation utility rather than an analysis skill. Therefore this is a clear description-behavior mismatch.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 93% confidence
- Finding
The skill instructs use of network access to crawl arbitrary user-provided URLs and file creation to generate an Excel report, but it does not declare any tool scope or permissions. Missing scope declarations reduce transparency and policy enforcement, making it easier for an agent to perform network and filesystem actions without clear user awareness or platform-level restriction.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The skill directs the agent to crawl a user-supplied website and generate a local Excel file without clearly warning about outbound network requests or filesystem writes. This can surprise users, enable unintended access to internal or sensitive URLs, and create artifacts on disk without explicit consent.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 80% confidence
- Finding
The instruction 'Output complete report (in target language)' imposes a language behavior as part of the skill flow. Although the user supplies a target language, the file does not state that conversation/report language is optional or user-adjustable beyond that parameter.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 78% confidence
- Finding
This line enforces a specific language output policy for generated content. Even though the workflow collects a target language, the document does not clearly frame this as an opt-in preference or offer flexibility if the user wants analysis in another language.
- Content
Static analysis
No suspicious patterns detected.