Security audit

Website Monitor

Security checks for vulnerabilities and agentic risk

Overview

The skill mostly matches its website-monitoring purpose, but it fetches unrestricted URLs and stores full page text in a broadly configurable state directory despite documenting hash-only storage.

Install only if you are comfortable with the agent fetching URLs from your machine and saving fetched page text locally. Use trusted URL lists, avoid monitoring private/internal endpoints unless intended, choose a private state directory you control instead of shared /tmp, clean old state files when no longer needed, and install dependencies in a dedicated environment with pinned versions where possible.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (3)

T09 · Insecure Skill Coding Practices

Error

Location: scripts/monitor.py:24
Finding: Unrestricted URL Fetching Enables Server-Side Request Forgery
Content: View full analysis
]*>.*?", "", resp.text, flags=re.DOTALL) text = re.sub(r"]*>.*?", "", text, flags=re.DOTALL) text = re.sub(r"<[^>]+>", " ", text) text = re.sub(r"\s+", " ", text).strip() return resp.status_code, text, elapsed except requests.exceptions.Timeout: elapsed = int((time.time() - start) * 1000) return 0, "", elapsed ``` All command modes ultimately pass caller-controlled URLs to this function. The relevant command arguments are defined at `scripts/monitor.py:153-166`: ```python p_check.add_argument("url") p_watch = sub.add_parser("watch", help="Detect changes vs last snapshot") p_watch.add_argument("url") p_watch.add_argument("--state-dir", default="/tmp/monitor-state") p_match = sub.add_parser("match", help="Check for content pattern") p_match.add_argument("url") p_match.add_argument("--pattern", required=True) p_batch = sub.add_parser("batch", help="Batch check from file") p_batch.add_argument("file") p_batch.add_argument("--state-dir", default="/tmp/monitor-state") ``` ### Technical Analysis The monitor makes outbound requests to user-controlled URLs without validating the URL scheme, hostname, port, or resolved IP address. It also enables automatic redirects through `allow_redirects=True` without validating each redirect destination. An attacker who can influence a direct command argument or an entry in a batch file can caus ...[truncated 1908 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/monitor.py:62
Finding: Caller-Controlled State Directory Permits Unsafe Filesystem Writes
Content: View full analysis
20: print(f" ... ({len(diff) - 20} more diff lines)") # Update state with open(state_file, "w") as f: f.write(text) return 1 else: print(f"📝 FIRST CHECK — {args.url} ({ms}ms, {len(text)} chars)") with open(state_file, "w") as f: f.write(text) return 0 ``` The same pattern is present in batch mode at `scripts/monitor.py:126-147`: ```python state_dir = args.state_dir or "/tmp/monitor-state" results = {"up": 0, "down": 0, "changed": 0} ...[truncated 3102 chars]
Remediation: View remediation

T08 · Insecure Dependencies

Note

Location: SKILL.md:60
Finding: Unpinned Third-Party Dependency Installation
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 91% confidence
Finding: The skill advertises and documents capabilities that perform network access and persistent file writes, but it does not declare any tool scope or permission boundary in the skill metadata. In an agent ecosystem, this creates a mismatch between what the skill can cause an agent to do and what reviewers or policy layers can easily see, increasing the chance of unintended outbound requests or disk writes being invoked without explicit user awareness.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 83% confidence
Finding: The documentation tells users to use a persistent state directory for monitoring but does not clearly warn that the skill stores page-derived data on disk over time. This can lead to unexpected retention of potentially sensitive webpage content, metadata, or diffs in shared or insecure temporary locations such as /tmp, especially on multi-user systems.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.