Security audit

WebsiteMonitor

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent website monitor, but its optional Linux service setup would run a persistent monitor as root without enough containment.

Before installing, treat the systemd section as needing review: run the monitor as a dedicated non-root user, restrict writable directories, pin dependencies, validate allowed target URLs, and escape report values. Avoid monitoring internal or sensitive endpoints unless that is intentional and approved.

A.I.G

Vulnerability Patterns

Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads

Findings (5)

T05 · Unauthorized Access and Privilege Escalation

Error

Location: SKILL.md:493
Finding: Website Monitor Service Runs with Unnecessary Root Privileges
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: SKILL.md:119
Finding: Unrestricted Monitoring URLs Permit SSRF-Style Internal Network Probing
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.md:262
Finding: Unescaped Configuration Values Allow Script Injection in Generated Reports
Content: View full analysis
{name} {s['url']} ``` ### Technical Analysis The target name and URL originate from configuration and are inserted directly into an HTML document using Python string interpolation. Neither value is HTML-escaped, and the URL scheme is not validated. A crafted target name can terminate the expected markup and insert arbitrary HTML, including script-capable elements or event handlers. A crafted URL can break out of the `href` attribute or use a dangerous scheme such as `javascript:`. Because the report is persisted to disk and later opened by an operator, this is a stored injection vulnerability. The generated page also lacks a restrictive Content Security Policy that could reduce the impact of injected active content. ### Attack Path 1. An attacker gains the ability to influence a target's `name` or `url` value in `config.json`. 2. The attacker inserts HTML, an event handler, an attribute-breaking payload, or a dangerous URL scheme. 3. The scheduled report generator embeds the value verbatim into the report. 4. An operator opens the generated HTML file. 5. The attacker's content executes in the report's browser context or executes when the malicious link is clicked. ### Impact Assessment Successful exploitation can execute attacker-controlled JavaScript in the browser context used to view the report. Potential effects include altering monitoring results displayed to the operator, phishing, navigating to attacker-controlled content, reading data available to the same page context, and making network requests with the viewer's browser. The exact scope depends on how reports are hosted. Reports served from a shared authenticated origin may present greater risk than reports opened as isolated local files. ] ...[truncated 2 chars]
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: SKILL.md:468
Finding: Python Dependencies Are Installed Without Version or Integrity Pinning
Content: View full analysis
Remediation: View remediation

T03 · Remote Payload Retrieval and Execution

Warning

Location: SKILL.md:336
Finding: Generated Reports Retrieve Mutable JavaScript from an External CDN
Content: View full analysis
``` ### Technical Analysis Every time a generated report is opened with network access, the browser retrieves and executes JavaScript from a third-party CDN. The dependency uses the mutable major-version selector `@4` rather than a reviewed exact release, and the script tag does not include a Subresource Integrity hash. Consequently, the effective code executed by a report can change after the Skill and generated report have been reviewed. The external host also receives request metadata when an operator views the report. There is no evidence in the audited project that jsDelivr or Chart.js is malicious. The risk arises from delegating future report execution to a mutable external resource without integrity verification. ### Attack Path 1. The CDN, package publication account, distribution path, or future compatible release is compromised or altered. 2. An operator opens a generated monitoring report. 3. The browser downloads the current script matching the mutable `@4` URL. 4. The browser executes the externally supplied JavaScript in the report context. 5. The altered script can manipulate displayed results, issue network requests, redirect the operator, or access information available to that page context. ### Impact Assessment Successful exploitation provides arbitrary JavaScript execution in the generated report's browser context. It can undermine report integrity, mislead operators, expose report-view metadata, and potentially access data associated with the report's hosting origin. The impact is greater when reports are hosted on an authenticated internal origin rather than opened as isolated local files. ]]>
Remediation: View remediation
``` - Apply a Content Security Policy restricting scripts to approved sources. - Prefer fully self-contained reports when offline portability and reproducibility are expected. - Record and review dependency updates instead of relying on mutable major-version URLs. ]]>

SkillSpector

Vulnerability Patterns

Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Rogue AgentSelf-Modification, Session Persistence
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (6)

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: 文件整体说明以中文规定技能行为，且后续生成的 HTML 报告标题、字段标签与文案也固定为中文，没有说明可根据用户偏好切换语言。按规则，这属于未获用户选择或显式说明的语言/locale 强制。
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 86% confidence
Finding: 该段使用“当用户提到以下场景时，请务必使用此 skill”并列出如“想要生成网站健康状况报告或可视化图表”等较宽泛描述，边界并不严格。文档没有给出负例或限制条件，容易与一般网站分析、报表生成或健康检查讨论发生语义重叠。
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The skill instructs creation of a scheduler that continuously performs outbound HTTP requests and persists monitoring data locally, but does not clearly foreground those side effects before use. In agent or semi-automated environments, insufficient disclosure can lead to unintended network activity, unexpected storage growth, and monitoring of internal or sensitive endpoints without informed user acknowledgment.
Content: No source excerpt is available for this finding.

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · SKILL.md (reported line 503)May include surrounding context.
text
```bash sudo systemctl enable website-monitor sudo systemctl start website-monitor

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · SKILL.md (reported line 504)May include surrounding context.
text
```bash sudo systemctl enable website-monitor sudo systemctl start website-monitor

Session Persistence

Medium

Category: Rogue Agent
Confidence: 80% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · SKILL.md (reported line 503)May include surrounding context.
text
```bash sudo systemctl enable website-monitor sudo systemctl start website-monitor

Static analysis

No suspicious patterns detected.