Security checks for vulnerabilities and agentic risk
Overview
This skill does what it claims broadly, but it can automatically fetch and transmit any pasted URL and article content to third parties without confirmation, with unsafe command and URL handling.
Review carefully before installing. Use it only if you are comfortable sending saved URLs, article metadata, and up to about 8000 characters of article text to Readwise and the configured LLM provider. Do not let it auto-process private, signed, internal, localhost, intranet, or sensitive links; require explicit save intent and prefer safer argument passing and URL validation before use.
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)
T09 · Insecure Skill Coding Practices
Error
Location
save_article.py:61
Finding
Arbitrary URL Fetching Enables Server-Side Request Forgery and Data Disclosure
Content
View full analysis
1000:
title = extract_title(html)
author = extract_author(html)
text = extract_text(html)
```
The workflow subsequently supplies the extracted response content to an external LLM:
```json
{
"input": {
"title": "",
"author": "<author from Step 1>",
"domain": "<domain from Step 1>",
"text": "<text_preview from Step 1>"
}
}
```
### Technical Analysis
The only URL validation is a string-prefix check for `http://` or `https://`. The implementation does not reject:
- Loopback destinations such as `127.0.0.1` and `[::1]`
- RFC 1918 private networks
- Link-local addresses, including cloud metadata services
- Reserved, multicast, or otherwise non-public addresses
- URLs containing embedded credentials
- Unexpected destination ports
- Publi
...[truncated 2097 chars]
Remediation
View remediation
T09 · Insecure Skill Coding Practices
Error
Location
SKILL.md:33
Finding
Untrusted URLs and LLM-Generated Tags Are Interpolated into Shell Commands
Content
View full analysis
Remediation
View remediation
T05 · Unauthorized Access and Privilege Escalation
Warning
Location
SKILL.md:26
Finding
Broad Automatic Activation Transmits URLs and Article Content Without Explicit Consent
Content
View full analysis
Save article links to Readwise Reader with automatic content-based tagging.
Specialized handling for WeChat Official Account (微信公众号) articles.
Use this skill whenever the user sends a URL, shares an article link, says
"save this", "save to Readwise", "存一下", "保存到 Readwise", "帮我收藏",
or pastes any http/https link — especially mp.weixin.qq.com links.
Also use when the user asks to batch-save multiple links.
```
The workflow expressly prohibits confirmation:
```markdown
When the user sends a message containing one or more URLs, execute these steps
**immediately without asking for confirmation**.
```
It then instructs the Agent to transmit article metadata and content to the LLM provider:
```json
{
"input": {
"title": "",
"author": "<author from Step 1>",
"domain": "<domain from Step 1>",
"text": "<text_preview from Step 1>"
}
}
```
### Technical Analysis
Saving a requested article to Readwise and classifying it with an LLM are consistent with the declared functionality when the user explicitly requests those actions. However, the trigger is broader than explicit save intent: it activates whenever the user merely pastes any HTTP(S) link.
A URL can itself contain sensitive information in its path or query string, including signed access parameters, document-sharing tokens, password-reset tokens, invitation tokens, tracking identifiers, or private resource identifiers. Fetching the link may additionally reveal private article or document content.
The workflow sends data to two separate external systems:
- Readwise receives at least the URL and tags, and ma
...[truncated 1710 chars]
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (15)
Tp4
High
Category
MCP Tool Poisoning
Confidence
96% confidence
Finding
The core purpose mostly aligns: the code saves article URLs to Readwise and includes specialized WeChat article handling. However, a key declared feature—automatic content-based tagging—is not implemented in this code; the docstring explicitly states tagging is not handled here and is delegated to the agent. Also, the description says it should be used for batch-saving multiple links, but the script only accepts one URL argument and has no batching logic. These are material discrepancies in advertised capability, even though the main save-to-Readwise behavior and WeChat support are accurately represented.
Content
No source excerpt is available for this finding.
Tp4
High
Category
MCP Tool Poisoning
Confidence
97% confidence
Finding
The declared description promises a broader save-to-Readwise skill that automatically derives tags from article content, has specialized behavior for WeChat articles, and is triggered whenever users share article URLs, including batch saves. The supplied code only accepts one URL and a list of manually supplied tags, then calls Readwise's save endpoint to set/update those tags. It does not inspect page content, perform any tagging logic, recognize or treat WeChat URLs differently, or iterate over multiple links. While it does interact with Readwise and can save/update a URL entry, the implemented behavior is materially narrower and different from the declared purpose.
Content
No source excerpt is available for this finding.
Missing User Warnings
Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding
The README explicitly describes a workflow that fetches article content, sends it to Readwise Reader, and then uses an external LLM service for content classification, but it does not clearly warn users that URLs and potentially article content will be transmitted to third-party services. This creates a real privacy and data-sharing risk, especially for private, paywalled, internal, or sensitive links that a user may assume are only being bookmarked.
Content
No source excerpt is available for this finding.
Undeclared Tool Scope
Medium
Category
MCP Least Privilege
Confidence
83% confidence
Finding
The skill declares required binaries and secrets and clearly performs networked actions, but it does not declare an explicit tool scope such as allowed-tools or permissions. That weakens containment and reviewability, making it easier for the skill to access broader capabilities than users or auditors expect.
Content
No source excerpt is available for this finding.
Vague Triggers
Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding
The trigger is extremely broad, including any pasted http/https link and common phrases like 'save this,' which can cause the skill to activate on routine conversation or unintended links. That raises the risk of accidental exfiltration of URLs and article content to external services without the user's informed intent.
Content
No source excerpt is available for this finding.
Missing User Warnings
Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding
The workflow instructs the agent to immediately fetch and save user-provided URLs to Readwise without confirmation or a clear notice that data will be transmitted to third-party services. This can cause unintended disclosure of sensitive or private links and creates an autonomy-plus-network side effect that users may not expect.
Content
No source excerpt is available for this finding.
Autonomous Decision Making
Medium
Category
Excessive Agency
Confidence
95% confidence
Finding
The instruction to act 'immediately without asking for confirmation' enables autonomous external actions on user content. In this context, the action is not merely local processing: it fetches remote content, saves it to a third-party account, and may trigger further tagging flows, so a mistaken activation has real privacy and integrity consequences.
Content
Scanner excerpt · SKILL.md (reported line 27)May include surrounding context.
md
## Workflow
When the user sends a message containing one or more URLs, execute these steps
**immediately without asking for confirmation**.
### Step 1 — Fetch and save the article
Missing User Warnings
Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding
The skill sends article metadata and up to 8000 characters of article text to an LLM classification tool, but the user is not warned that content is being shared with another external processor. This is more sensitive than merely saving a URL because it can transmit substantial proprietary, private, or regulated text beyond what the user intended to share.
Content
No source excerpt is available for this finding.
Session Persistence
Medium
Category
Rogue Agent
Confidence
60% confidence
Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content
Scanner excerpt · SKILL.md (reported line 79)May include surrounding context.
json
{
"prompt": "You are a document classifier. Read the document and return 2-5 tags as a JSON array of strings. PREFER tags from the taxonomy. If the content's central subject is not covered, create a new specific tag (1-3 words, same specificity as existing tags). Never create broad tags like 'Technology' or 'Finance'. Never assign 'favorite' or 'shortlist'.\n\nTAXONOMY:\n- AI agent: AI agents, autonomous systems, agentic workflows, tool-use architectures\n- Chips: semiconductors, chip design, GPU/TPU, NVIDIA/AMD/TSMC, export controls\n- AI 上下文: context windows, RAG, prompt engineering, foundation models, broader AI landscape\n- VC: venture capital, fund mechanics, early-stage investments, seed/pre-A/series-A\n- PE: private equity, series-B/C/D, buyouts, LBO mechanics\n- Fundraising: LP/GP dynamics, new LP allocation trends\n- Private Credit: direct lending, BDCs, unitranche, mezzanine, private debt\n- Equity: public equities, stock analysis, earnings, equity research, trading ideas\n- M&A: mergers, acquisitions, deal-making, corporate restructuring\n- Market: broad market conditions, macro outlook, cross-asset dynamics\n- Family Office: family office structures, ultra-HNW wealth management\n- Launching Fund: starting a fund, emerging manager playbooks, GP fundraising\n- Politics: domestic politics, elections, government policy (single country; NOT cross-border)\n- IR: international relations, foreign policy, diplomacy, geopolitics, great-power competition\n- Economics: macroeconomics, monetary/fiscal policy, trade economics\n- infra: infrastructure investment, physical/digital infrastructure\n- Consumer: consumer markets, retail, CPG, consumption-driven analysis\n- Startup Growth: startup scaling, growth strategies, go-to-market, PMF\n- Founder: founder-centric advice, founder stories, lessons from building\n- China, US, Europe, Middle East: apply when region is primary focus\n- Ray Dalio, Paul Graham, Howard Marks, 黄铮, Trump: apply ONLY if person is centr
...[truncated 25 chars]
Natural-Language Policy Violations
Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding
The prescribed success, partial, and failure responses are all written in Chinese, and the instructions tell the agent to report the result accordingly. There is no indication that the user can choose language or that the skill is explicitly restricted to a Chinese-speaking context.
Content
No source excerpt is available for this finding.
Intent-Code Divergence
Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding
The inline documentation states, "Does NOT handle tagging — that is delegated to the agent via llm-task," while the skill manifest presents automatic content-based tagging as part of the skill's behavior. This is an active contradiction between documented intent and the advertised skill behavior.
Content
No source excerpt is available for this finding.
Description-Behavior Mismatch
Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding
The manifest describes this skill as saving article links to Readwise Reader with automatic content-based tagging. However, this file's module docstring explicitly states it does not handle tagging, and the implementation only forwards a single provided tag (defaulting to "openclaw") to Readwise rather than deriving tags from article content.
Content
No source excerpt is available for this finding.
Missing User Warnings
Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding
The skill fetches full article HTML/text and then transmits article content, title, URL, and tags to the Readwise API, which can expose sensitive or private article contents to a third party without any explicit user-facing consent step. In this skill context, users may reasonably expect link saving, but not necessarily server-side content extraction and forwarding, especially for private, tokenized, or internal URLs.
Content
No source excerpt is available for this finding.
Description-Behavior Mismatch
Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding
The file explicitly implements tag updates on existing Readwise entries, while the skill manifest describes a link-saving skill. That capability creates a scope mismatch: if invoked in the advertised context, the skill can modify metadata on prior saved items rather than only adding a new article, which can lead to unintended tampering with a user's library organization. In this skill context, automatic content-based tagging makes the behavior somewhat expected, but updating pre-existing entries is still more powerful than the manifest suggests and should be disclosed and constrained.
Content
No source excerpt is available for this finding.
Natural-Language Policy Violations
Low
Category
Not specified by scanner
Confidence
92% confidence
Finding
The WeChat request headers explicitly set Accept-Language to "zh-CN,zh;q=0.9,en;q=0.8", which imposes a locale preference in outbound requests. The file does not offer a user choice or document a justified locale constraint, so this is a natural-language locale policy concern.
