skill-feedback-collector

• Outcome: Review
• Latest audit: Sep 12, 2026 · 12:03 AM UTC
• Version: 1.0.2

Overview

The skill appears to be a real feedback tool, but its default network control panel can expose history and let reachable clients steer the agent.

Review carefully before installing. Only run it on localhost or a trusted, firewalled network; set a strong FEEDBACK_TOKEN; avoid putting secrets in feedback; clear feedback-history.json regularly; and do not let queued browser/API tasks bypass the agent's normal safety and confirmation rules.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (4)

T01 · Skill Instruction Hijacking

Error

• Location: SKILL.md:27

Finding

Unauthenticated Remote Task Queue Can Inject Instructions into the AI Agent

Content

View full analysis

= 0 && data.index < taskQueue.length) { taskQueue.splice(data.index, 1); broadcastQueueState(); } } else if (data.action === "clear") { taskQueue.length = 0; broadcastQueueState(); } else if (data.action === "reorder" && Array.isArray(data.tasks)) { taskQueue.length = 0; taskQueue.push(...data.tasks.filter((t: unknown) => typeof t === "string" && (t as string).trim())); broadcastQueueState(); } else if (data.action === "autoMode" && typeof data.enabled === "boolean") { autoMode = data.enabled; broadcastQueueState(); } res.writeHead(200, { "Content-Type": "application/json", ...cors }); res.end(JSON.stringify({ ok: true, tasks: [...taskQueue], autoMode })); } catch { res.writeHead(400, { "Content-Type": "application/json", ...cors }); res.end(JSON.stringify({ error: "Invalid JSON" })); } retur ...[truncated 3379 chars]

Remediation

View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: src/index.ts:90

Finding

Network Service Exposes Agent Controls and Conversation History without Authentication by Default

Content

View full analysis

{ if (AUTH_TOKEN && !checkAuth(req)) { rawWs.close(4001, "Unauthorized"); return; } const ws = rawWs as TrackedSocket; ``` `src/index.ts:454-462`: ```ts httpServer.listen(WS_PORT, "0.0.0.0", () => { console.error( `[feedback-collector] UI & WebSocket server listening on http://0.0.0.0:${WS_PORT}` ); if (AUTH_TOKEN) { console.error(`[feedback-collector] Auth enabled. Use ?token=${AUTH_TOKEN} or Authorization header.`); } }); ``` ### Technical Analysis The service binds to `0.0.0.0`, exposing it on every available network interface. Authentication is optional, and `checkAuth()` authorizes every request when `FEEDBACK_TOKEN` is empty. The WebSocket handler uses the same optional-authentication model. Consequently, the default configuration makes all sensitive API and WebSocket capabilities a ...[truncated 2042 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: client/index.html:358

Finding

Bundled Browser Client Does Not Propagate the Documented Authentication Token

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: src/index.ts:128

Finding

Unbounded HTTP Request Body Buffering Allows Remote Memory Exhaustion

Content

View full analysis

{ return new Promise((resolve) => { const chunks: Buffer[] = []; req.on("data", (c: Buffer) => chunks.push(c)); req.on("end", () => resolve(Buffer.concat(chunks).toString("utf-8"))); }); } ``` The unbounded helper is used by multiple remotely reachable endpoints: ```ts if (req.url === "/api/feedback" && req.method === "POST") { const body = await readBody(req); ``` ```ts if (req.url === "/api/toggle" && req.method === "POST") { const body = await readBody(req); ``` ```ts if (req.url === "/api/queue" && req.method === "POST") { const body = await readBody(req); ``` ### Technical Analysis `readBody()` retains every received chunk in an array and then allocates another buffer with `Buffer.concat()`. It does not enforce a maximum body size, reject an excessive `Content-Length`, limit request duration, or stop reading after a threshold. An attacker can therefore send a very large POST body or maintain multiple concurrent uploads. Memory consumption includes the retained chunks and the concatenated copy. Sufficient input can cause severe garbage-collection pressure, event-loop degradation, process termination due to an out-of-memory condition, or host-level resource exhaustion. Authentication does not fully mitigate this coding flaw because authenticated or compromised clients can still exploit it. Under the default empty-token configuration, it is remotely exploitable by any client that can reach the port. ### Attack Path 1. The server starts and exposes the HTTP interface. 2. An attacker opens one or more POST requests to `/api/feedback`, `/api/toggle`, or `/a ...[truncated 860 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (30)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · .gitignore (reported line 9)May include surrounding context.

text

feedback-history*.json

*.log
.env
role.md

Credential Access

High

• Category: Privilege Escalation
• Confidence: 94% confidence

Finding

The skill documents an optional FEEDBACK_TOKEN while also stating the server binds to 0.0.0.0 by default and is reachable over HTTP/WebSocket. If deployed without the token or firewall restrictions, unauthorized users on the network could connect to the UI, read task summaries, inject responses, and steer the agent through the feedback loop.

Content

Scanner excerpt · SKILL.md (reported line 86)May include surrounding context.

md

| Env Variable | Default | Description |
|---|---|---|
| `FEEDBACK_PORT` | `18061` | HTTP and WebSocket port |
| `FEEDBACK_TOKEN` | (empty) | Optional access token for the UI |

## Workflow

Known Vulnerable Dependency: fast-uri==3.1.0 — 7 advisory(ies): CVE-2026-13676 (fast-uri vulnerable to host confusion via failed IDN canonicalization); CVE-2026-18446 (fast-uri vulnerable to host confusion via backslash authority introducer); CVE-2026-75975 (fast-uri vulnerable to server-side request forgery via malformed IPv6 normalizat) +4 more

High

• Category: Supply Chain
• Confidence: 89% confidence

Finding

fast-uri 3.1.0 has multiple host parsing and canonicalization issues, including SSRF-relevant confusion bugs. This matters more in an MCP skill that may process URLs, callbacks, or remote endpoints through its SDK stack, because malformed attacker-controlled URLs could bypass host validation and cause unintended network access.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: hono==4.12.7 — 16 advisory(ies): CVE-2026-56762 (Hono missing validation of cookie name on write path in setCookie()); CVE-2026-47676 (Hono: app.mount() strips mount prefix using undecoded path, causing incorrect ro); CVE-2026-47675 (Hono: Cookie helper does not sanitize sameSite and priority, allowing Set-Cookie) +13 more

High

• Category: Supply Chain
• Confidence: 91% confidence

Finding

hono 4.12.7 is associated with numerous advisories covering cookie handling, routing, and path/mount behavior. Because this skill explicitly presents a browser UI and pauses for human input, routing and cookie flaws in the HTTP framework are more relevant than in a pure local library, potentially affecting session integrity, route protection, or request handling.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: ip-address==10.1.0 — 2 advisory(ies): CVE-2026-69192 (ip-address: Address4 decodes leading-zero octets as decimal while resolvers deco); CVE-2026-42338 (ip-address has XSS in Address6 HTML-emitting methods)

High

• Category: Supply Chain
• Confidence: 80% confidence

Finding

ip-address 10.1.0 includes address parsing inconsistencies and an HTML-emitting XSS issue. In this dependency tree it is brought in by express-rate-limit, so exploitability depends on whether the application surfaces parsed address output or relies on this parser for network trust decisions; if it does, address confusion could weaken SSRF/IP-allowlist protections.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: path-to-regexp==8.3.0 — 2 advisory(ies): CVE-2026-4923 (path-to-regexp vulnerable to Regular Expression Denial of Service via multiple w); CVE-2026-4926 (path-to-regexp vulnerable to Denial of Service via sequential optional groups)

High

• Category: Supply Chain
• Confidence: 88% confidence

Finding

path-to-regexp 8.3.0 is flagged for ReDoS/DoS conditions involving crafted route patterns or matching behavior. Since this skill likely runs an HTTP interface for browser-based human feedback, a route-matching denial of service could affect availability if exposed to untrusted clients, though it is less severe when bound only to localhost.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: ws==8.19.0 — 2 advisory(ies): CVE-2026-45736 (ws: Uninitialized memory disclosure); CVE-2026-48779 (ws: Memory exhaustion DoS from tiny fragments and data chunks)

High

• Category: Supply Chain
• Confidence: 93% confidence

Finding

ws 8.19.0 is flagged for memory disclosure and memory exhaustion DoS issues. This is especially relevant for a human-in-the-loop feedback collector with a browser UI and task queue, because WebSocket communication is a plausible transport for live updates; if reachable by an attacker, it can lead to service instability or potential data exposure from process memory.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: ws==8.19.0 — 2 advisory(ies): CVE-2026-45736 (ws: Uninitialized memory disclosure); CVE-2026-48779 (ws: Memory exhaustion DoS from tiny fragments and data chunks)

High

• Category: Supply Chain
• Confidence: 98% confidence

Finding

The package depends on ws in a context where WebSocket handling is part of the core feature, and version 8.19.0 is flagged with advisories for uninitialized memory disclosure and memory exhaustion DoS. Because this skill collects human feedback through a browser UI over WebSockets, exploitation of the WebSocket layer is especially relevant and can lead to information exposure or service disruption.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The README presents all user-facing instructions and usage examples in Chinese, and does not indicate that other languages are available or that Chinese is required for a justified region-specific purpose. This can violate language/locale policy when users are not given a choice or explicit opt-in.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 83% confidence

Finding

The skill exposes environment-driven behavior (FEEDBACK_PORT, FEEDBACK_TOKEN) and a network-facing service, but the manifest does not declare any explicit tool scope or permission boundaries. In practice this makes the skill's capabilities less transparent to the agent/runtime and increases the chance it is activated or deployed without appropriate review of its network exposure and secret handling.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The description says to use the skill for broad, routine situations such as completing tasks, uncertainty, confirmation, or asking instead of guessing. That wide trigger surface can cause the skill to activate in many normal workflows, unnecessarily exposing task content and prompts to the browser UI, local history file, and any reachable client connected to the feedback service.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The document explicitly sets the page language to zh-CN, which imposes a specific locale choice. Under the policy, forcing a language or locale without opt-in or clear region-specific justification is a natural-language policy concern.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 80% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · client/index.html (reported line 264)May include surrounding context.

html

</div>
      <div class="queue-body">
        <div class="queue-input-row">
          <input type="text" id="queueInput" placeholder="Add a task to the queue...">
          <button id="queueAddBtn">Add</button>
        </div>
        <ul class="queue-list" id="queueList">

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 83% confidence

Finding

This code presents queued tasks as being for "auto-execution," which implies later automated actions that could affect system state, but the UI provides no visible warning, confirmation, or explanatory text about what those tasks will do. For a code file, safety-relevant automated execution behavior should have some user-facing disclosure when exposed in the interface.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

AI and human feedback text is stored on disk in a persistent JSON file with no visible consent, retention, or sensitivity controls. Because this skill is specifically designed to collect interactive human input, it is likely to capture secrets, internal task details, and personal data that could later be exposed from disk or backups.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The export endpoint returns the full stored feedback history, which may contain sensitive AI and human conversation content. In this skill context, the endpoint increases exfiltration risk because the service is network-accessible and designed to aggregate potentially sensitive task discussions over time.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The server logs the authentication token directly, exposing the shared secret to anyone with access to stdout, process logs, container logs, or centralized logging systems. Since that token protects both HTTP API and WebSocket access, disclosure can lead to unauthorized control of feedback mode, queue operations, and access to stored history.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The tool contract says it waits for human feedback, but when the queue is non-empty it returns a queued task automatically without any human response. In a human-in-the-loop control skill, this semantic mismatch can bypass confirmation gates and cause downstream agents to treat machine-supplied queue items as approved human input.

Content

No source excerpt is available for this finding.

Vague Triggers

Low

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The usage guidance gives positive examples for many common scenarios but lacks clear guardrails and negative examples. Without stronger constraints, agents may overuse the skill and send unnecessary sensitive context to the feedback channel or enter an unintended confirmation loop, increasing exposure rather than directly creating code execution risk.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 77% confidence

Finding

The export button directly opens the history export endpoint, which likely transfers conversation history out of the current view, but there is no inline warning or explanatory text about what data will be exported. This is a user-data-affecting operation and the code does not provide any visible disclosure beyond the button label.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: @hono/node-server==1.19.11 — 2 advisory(ies): CVE-2026-39406 (@hono/node-server: Middleware bypass via repeated slashes in serveStatic); GHSA-frvp-7c67-39w9 (Node.js Adapter for Hono: Path traversal in `serve-static` on Windows via encode)

Low

• Category: Supply Chain
• Confidence: 86% confidence

Finding

The lockfile pins @hono/node-server 1.19.11, and the listed advisories affect static file serving and path handling. Even though this skill is a feedback collector rather than a generic file server, MCP/browser-facing tooling commonly exposes HTTP endpoints, so middleware bypass or Windows path traversal in the server adapter can become reachable if static assets or local UI files are served.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: body-parser==2.2.2 — 1 advisory(ies): CVE-2026-12590 (body-parser vulnerable to denial of service when invalid limit value silently di)

Low

• Category: Supply Chain
• Confidence: 78% confidence

Finding

body-parser 2.2.2 is flagged for a denial-of-service condition related to invalid limit handling. In this skill, the issue is likely only reachable if attacker-controlled HTTP request bodies are accepted by a web endpoint, which is plausible for a browser-based feedback UI but generally results in availability impact rather than code execution or data compromise.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: qs==6.15.0 — 3 advisory(ies): CVE-2026-82417 (qs: Denial of Service via Attacker Controlled isBuffer); CVE-2026-8723 (qs has a remotely triggerable DoS: qs.stringify crashes with TypeError on null/u); CVE-2026-82562 (qs array-limit bypass via bracket-key comma parsing)

Low

• Category: Supply Chain
• Confidence: 77% confidence

Finding

qs 6.15.0 has several denial-of-service and parsing edge-case advisories. In this context the likely impact is limited to request/query parsing instability in the browser-facing service, which is still a real availability concern if an attacker can send crafted requests.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 40% confidence

Finding

Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.

Content

Scanner excerpt · package.json (reported line 21)May include surrounding context.

json

],
  "license": "MIT",
  "dependencies": {
    "@modelcontextprotocol/sdk": "^1.12.1",
    "ws": "^8.18.0"
  },
  "devDependencies": {

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 95% confidence

Finding

The ws dependency is specified with a caret range, which can resolve to vulnerable versions such as 8.19.0, and the static finding already links that package line to known high-severity advisories. In this skill, ws is central to the browser/UI feedback channel, so a vulnerable WebSocket library directly affects the exposed network-facing component and can enable memory disclosure or denial of service.

Content

Scanner excerpt · package.json (reported line 22)May include surrounding context.

json

"license": "MIT",
  "dependencies": {
    "@modelcontextprotocol/sdk": "^1.12.1",
    "ws": "^8.18.0"
  },
  "devDependencies": {
    "@types/node": "^22.15.0",