T09 · Insecure Skill Coding Practices
Error
- Location
scripts/global_coverage.js:4- Finding
Hard-Coded ScraperAPI Credential Transmitted over Plaintext HTTP
- Content
View full analysis
- Remediation
View remediation
Security audit
ScraperAPI Global Access
Security checks for vulnerabilities and agentic risk
Overview
The skill is a proxy-based web testing tool, but its published instructions overstate generic use while shipped scripts hardcode a ScraperAPI key and send analytics-triggering traffic to a fixed site.
Review carefully before installing or running. The scripts may send requests through ScraperAPI, trigger analytics/tracking systems, and currently target faceswap.cool rather than a URL you provide. Do not use it with sensitive or unauthorized sites, and the publisher should remove the embedded API key, switch to HTTPS, make the target URL truly user-controlled, and document analytics side effects clearly.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/global_coverage.js:275- Finding
CSV Formula Injection through Untrusted Report Fields
- Content
View full analysis
`${r.country},${r.region},${r.page},${r.success ? 'Success' : 'Failed'},${r.responseTime},"${(r.title || r.error || '').replace(/"/g, '""')}",${r.timestamp}` ).join('\n'); fs.writeFileSync('exploration_results.csv', csvHeader + csvData); ``` From `scripts/generate_report.js`: ```javascript const csvHeader = 'Country,Region,Page,Status,ResponseTime,Title,Timestamp\n'; const csvData = progressData.results.map(r => `${r.country},${r.region},${r.page},${r.success ? 'Success' : 'Failed'},${r.responseTime},"${(r.title || r.error || '').replace(/"/g, '""')}",${r.timestamp}` ).join('\n'); fs.writeFileSync('exploration_results.csv', csvHeader + csvData); ``` ### Technical Analysis The report generators place values from fetched page titles, request errors, and `progress.json` directly into CSV cells. The implementation escapes double quotes, but it does not neutralize spreadsheet formula prefixes such as `=`, `+`, `-`, or `@`. CSV quoting is a serialization measure and does not reliably prevent spreadsheet applications from interpreting a cell as a formula. Consequently, a title or persisted field beginning with a dangerous prefix may be evaluated when a user opens or imports the advertised CSV report in software such as Microsoft Excel or another formula-capable spreadsheet application. The `global_coverage.js` script derives `r.title` from remote HTML and persists it. The standalone `generate_report.js` script also trusts the contents of the local `progress.json` file without schema or content validation. ### Attack Path Remote-content path: 1. An attacker gains control o ...[truncated 1678 chars]- Remediation
View remediation
[ r.country, r.region, r.page, r.success ? 'Success' : 'Failed', r.responseTime, r.title || r.error || '', r.timestamp ].map(safeCsvCell).join(',')).join('\n'); ``` 5. Validate `progress.json` against a strict schema before processing it, including field types, maximum lengths, and expected values. 6. Add tests covering formula prefixes, embedded quotes, commas, line breaks, and Unicode control characters. 7. Warn users that exported CSV files contain remotely derived content and should be opened with formula evaluation and external content disabled. ]]>
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (28)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The declared description presents a network-capable global website access/testing skill with proxy support, rendering, simulation, monitoring, and resume features. However, this code chunk does not perform web access, proxy selection, rendering, automation, or monitoring collection. It strictly processes previously collected data from a local file and outputs summary reports in JSON and CSV formats. Performance reporting is present only as aggregation of existing data, which is a supporting/reporting function rather than the advertised primary capability. Therefore, the supplied code materially differs from the declared purpose.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 94% confidence
- Finding
The description presents a general-purpose global proxy/web access skill with extensive capabilities, but the supplied code is a narrow, single-purpose script. It targets one hardcoded website, visits only three paths across seven countries, and is primarily geared toward generating JS-rendered page visits that may show up in Google Analytics. While there is partial alignment on multi-country access and JS rendering, several prominent declared features are missing or overstated: there is no 25+ country implementation, no meaningful user behavior simulation beyond a random session number, no breakpoint-resume mechanism, and no real performance monitoring beyond basic response size/status logging. Therefore the declared description materially overstates and misrepresents the actual behavior.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
A live ScraperAPI key is hardcoded directly in source and then used in outbound requests, making credential exposure likely through source disclosure, logs, reuse in other environments, or repository leaks. An attacker who obtains the key could abuse the third-party account for unauthorized scraping, incur charges, exhaust quotas, or tie malicious traffic back to the account owner.
- Content
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md node scripts/global_coverage.js --url https://example.com
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md node scripts/global_coverage.js --url https://example.com
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md node scripts/global_coverage.js --url https://example.com
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md node scripts/global_coverage.js --url https://example.com
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md node scripts/global_coverage.js --url https://example.com
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md node scripts/user_journey.js --url https://example.com --countries us,uk,jp
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md node scripts/user_journey.js --url https://example.com --countries us,uk,jp
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md node scripts/user_journey.js --url https://example.com --countries us,uk,jp
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The manifest describes a general-purpose global access skill for visiting websites from 25+ countries with JS rendering and user-behavior simulation. In code, the target is fixed to a single domain, https://faceswap.cool, and all journeys and reporting are specialized around that site, which is a materially narrower behavior than the claimed reusable capability.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
The file's user-facing logs and descriptive comments are written exclusively in Chinese, including status messages and report headings. This imposes a specific language/locale without any opt-in or documented justification, which matches the language-policy violation category.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The script sends user-derived browsing targets and metadata to api.scraperapi.com without any disclosure, consent flow, or clear indication that a third-party proxy/scraping service will receive the destination URL, country selection, and rendered content request. In a skill context, silent transmission to a third party increases privacy, compliance, and trust risks, especially because the skill simulates browsing behavior across many jurisdictions.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
A live ScraperAPI credential is hardcoded directly in the script, exposing a secret that can be reused by anyone with access to the code. This can lead to unauthorized consumption, billing abuse, account compromise, and attribution of abusive traffic to the credential owner.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The script is narrowly designed to drive Google Analytics-visible traffic to a hardcoded third-party site (faceswap.cool) from multiple countries, rather than offering a general-purpose scraping or monitoring capability suggested by the skill metadata. This can be used to manipulate analytics, create misleading traffic signals, or conduct covert promotional/validation activity through proxy infrastructure.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The script sends outbound requests to a third-party proxy service and intentionally attempts to trigger Google Analytics on the destination site without clear user consent or disclosure. In a skill context, hidden external transmission and metric-affecting behavior increase the risk of privacy issues, policy violations, and misuse by unsuspecting users.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The code explicitly enables JavaScript rendering and frames success as 'GA should be able to see it,' showing intent to create analytics-tracked visits rather than merely retrieve page content. In the context of a proxy/scraping skill, this makes the capability more dangerous because it can be used to fabricate engagement metrics or evade simple bot detection through geo-distributed requests.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The skill relies on ScraperAPI to fetch target URLs through third-party proxy infrastructure, but it does not clearly disclose that target URLs and visit metadata are transmitted to an external service. Users may unknowingly send confidential URLs, parameters, or monitoring patterns to a third party, creating privacy, contractual, or compliance risk.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The skill explicitly supports JS rendering and user behavior simulation to trigger Google Analytics, Facebook Pixel, and similar systems, but it lacks a clear warning that using it will intentionally activate third-party tracking and analytics. This can generate misleading telemetry, interact with consent-dependent tracking flows, or create legal/privacy issues when used without authorization.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The package description is written only in Chinese, which can impose a specific language on users without indicating any language choice or opt-in. Under the policy for natural-language violations, this is a locale/language constraint that is not documented as region-specific or optional.
- Content
Unpinned Dependencies
Low
- Category
- Supply Chain
- Confidence
- 93% confidence
- Finding
The dependency uses a semver range (^1.6.0) instead of an exact pinned version, which can lead to non-reproducible installs and unexpected package changes over time. In a security-sensitive skill that relies on network access and proxying, this increases supply-chain risk because different environments may resolve to different axios releases, including potentially vulnerable or compromised ones.
- Content
json "author": "家庭助手", "license": "MIT", "dependencies": { "axios": "^1.6.0" }, "engines": { "node": ">=14.0.0"
Unverifiable Dependency: axios has 16 known advisory(ies) (CVE-2026-44494 (axios Vulnerable to Full Man-in-the-Middle via Prototype Pollution Gadget in `co); CVE-2026-44495 (axios Vulnerable to Credential Theft and Response Hijacking via Prototype Pollut); CVE-2025-62718 (Axios has a NO_PROXY Hostname Normalization Bypass that Leads to SSRF) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected
Low
- Category
- Supply Chain
- Confidence
- 91% confidence
- Finding
The manifest references axios without exact pinning, while the package family has multiple known advisories, including SSRF- and proxy-related issues in some releases. Because this skill's stated purpose is global web access via proxies and remote fetching, any unresolved axios vulnerability is more dangerous in context and could affect outbound request security, credential handling, or request routing behavior.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
This JavaScript file contains multiple natural-language comments and console messages only in Chinese, such as the status messages and report headings. That imposes a specific language/locale on users without any visible opt-in, fallback, or justification, which matches the policy category for language or locale violations.
- Content
Intent-Code Divergence
Low
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The manifest advertises support for '25+ countries', suggesting more than 25. The code comment and array content show a fixed list of exactly 25 countries, so the stated capability overstates what the implementation currently provides.
- Content
Static analysis
Detected: suspicious.exposed_secret_literal
File appears to expose a hardcoded API secret or token.
Critical
- Code
- suspicious.exposed_secret_literal
- Location
- scripts/global_coverage.js:4
File appears to expose a hardcoded API secret or token.
Critical
- Code
- suspicious.exposed_secret_literal
- Location
- scripts/user_journey.js:3