secure-url-fetcher
Warn
Audited by Gen Agent Trust Hub on Aug 31, 2026
Risk Level: MEDIUMDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [DYNAMIC_EXECUTION]: The
__init__.pyfile and the test suite (tests/test_secure_fetcher.py) utilizeimportlib.utilandexec_moduleto dynamically loadsecure-fetcher.py. This is done to handle a script filename containing a hyphen, which prevents standard Python import syntax. - [INDIRECT_PROMPT_INJECTION]: The skill's primary function is to fetch data from external URLs provided by the user or agent, which may contain malicious instructions targeting the LLM. * Ingestion points: External HTTP/HTTPS response data fetched via
urllib3insecure-fetcher.py. * Boundary markers: None identified; the skill returns the raw response body as a string. * Capability inventory: Network read operations viaurllib3.PoolManager.request. * Sanitization: The content is decoded as UTF-8 witherrors='replace', but no structural validation or sanitization for LLM instructions is performed.
Audit Metadata