web-reader

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 0.90). The skill deliberately forwards full target URLs (including query strings) to an external service (r.jina.ai), which can exfiltrate sensitive tokens/credentials, and documents a bash fallback that bypasses the tool's URL safety guard.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.95). SKILL.md instructs the runtime to call the read_url tool with an arbitrary user-supplied URL, which the tool sends to the external Jina Reader service and returns the fetched page’s Markdown as content, so outsider-authored free text from public web pages is ingested into the agent’s LLM context.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill's read_url tool forwards the full target URL at runtime to the external Jina Reader service (r.jina.ai), so content fetched from r.jina.ai can directly control the agent's context/prompting.