A
100/100 First Seen
Feb 18, 2026
Last Scanned
Feb 22, 2026
Findings
1
Score
100/100
LOW 1
Findings (1)
LOW
User-provided URL consumed by agent
L74 Detects skills where user-provided URLs are consumed and processed by the agent
fetch-text', { url: input.url FIX
Validate and sanitize user-provided URLs before fetching them. Implement URL allowlisting, block private/internal IP ranges, and treat fetched content as untrusted data.
FP?
Likely FP if the skill is a web browser or URL fetcher where consuming user-provided URLs is the documented core feature with appropriate sandboxing.