Security checks for vulnerabilities and agentic risk
Overview
This UI testing skill has a coherent purpose, but it needs review because it stores sensitive test evidence and generates executable scripts and HTML reports without enough safeguards.
Use this only with trusted test sessions in an isolated workspace. Avoid recording secrets or production accounts, inspect generated .sh and .bat files before running them, and do not share generated HTML reports until screenshots, URLs, typed values, and embedded files have been reviewed or redacted.
'}
```
### Technical Analysis
The report generator constructs an HTML document with Python string interpolation but does
...[truncated 2298 chars]
Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
Location
scripts/save_test_report.py:44
Finding
Arbitrary Local File Disclosure Through Unrestricted Screenshot Paths
Content
View full analysis
str:
"""将图片转为 base64 data URI，若文件不存在则返回占位符。"""
if not path or not os.path.exists(path):
return ""
ext = os.path.splitext(path)[1].lower().lstrip(".")
mime = {"jpg": "jpeg", "jpeg": "jpeg", "png": "png",
"gif": "gif", "webp": "webp"}.get(ext, "png")
with open(path, "rb") as f:
data = base64.b64encode(f.read()).decode()
return f"data:image/{mime};base64,{data}"
```
The path is taken directly from session data:
```python
shot_path = step.get("screenshot", "")
img_src = embed_image(shot_path)
```
### Technical Analysis
The `screenshot` field is treated as a trusted filesystem path. The generator checks only whether the path exists before opening and reading it.
There is no validation that:
- The path is inside an approved screenshot directory.
- The path identifies a regular file.
- The file is a genuine supported image.
- The path does not traverse outside the test output directory.
- The path is not a symbolic link to another file.
- The file is within a safe size limit.
File type handling relies only on the filename extension. Unknown extensions default to the PNG media type, but the original bytes are still Base64-encoded into the HTML and can be recovered from the report source.
### Attack Path
1. An attacker creates or modifies a session file.
2. The attacker sets a step's `screenshot` field to an absolute path, traversal path, or symbolic link referencing a sensitive file readable by the current user.
3. A user runs `save_test_report.py` against the crafted session.
4. The generator opens the referenced file with the user's filesystem privileges.
5. The entire file is Base64-encoded into the generated HTML report.
6. The
...[truncated 791 chars]
The description promises an end-to-end UI automation testing skill with browser execution, recording, screenshot capture, and final reporting. This code chunk is a narrower utility: it reads a previously recorded session and saves it as replayable shell/batch scripts and a JSON test description. That is related to the declared domain, but materially incomplete versus the stated primary purpose. There are no obvious undeclared malicious capabilities; the mismatch is that the implemented functionality is only the test-script export portion of the advertised workflow.
Content
No source excerpt is available for this finding.
Undeclared Tool Scope
Medium
Category
MCP Least Privilege
Confidence
92% confidence
Finding
The skill instructs the agent to read and write local files such as session data, generated scripts, screenshots, and HTML reports, but it declares no explicit tool scope or permission boundaries. This creates an authorization gap where the agent may access or modify filesystem content beyond what users expect, increasing the risk of unintended data exposure or overwriting local files.
Content
No source excerpt is available for this finding.
Missing User Warnings
Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding
The skill is designed to capture screenshots, record detailed user actions, and embed evidence into a standalone HTML report, but it does not warn users that potentially sensitive on-screen data and interaction history will be stored. This can lead to inadvertent collection and persistence of credentials, personal data, internal URLs, or other confidential information.
Content
No source excerpt is available for this finding.
Natural-Language Policy Violations
Medium
Category
Not specified by scanner
Confidence
80% confidence
Finding
The skill title and operational instructions are written as mandatory Chinese-language guidance, and the trigger list mixes languages but does not indicate that users may interact in their preferred language. This creates a natural-language locale constraint without opt-in or justification, which can violate language/locale policy requirements.
Content
No source excerpt is available for this finding.
Natural-Language Policy Violations
Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding
The file's module docstring and usage/help text force a specific language for user-facing instructions. Under the policy, language constraints should be opt-in or clearly justified as region-specific; neither is present here.
Content
No source excerpt is available for this finding.
Missing User Warnings
Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding
The script writes a full HTML report that includes embedded screenshots and step metadata such as URLs, selectors, input values, and error messages. Although the file write is logged after completion, there is no user-facing warning in the code documentation that the generated report may contain sensitive data copied from the session and screenshots.
Content
No source excerpt is available for this finding.
Missing User Warnings
Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding
The script serializes recorded session commands directly into runnable .sh and .bat files with no validation, escaping, or trust boundary enforcement. Because session steps come from recorded data and are emitted as raw shell lines, any injected or malformed command in the session file becomes executable when a user later runs the generated script, creating a command-injection and unsafe code-generation risk.
Content
No source excerpt is available for this finding.
Natural-Language Policy Violations
Low
Category
Not specified by scanner
Confidence
95% confidence
Finding
The HTML output hard-codes the document language to zh-CN, and the surrounding user-facing strings are also fixed in Chinese. This is a natural-language locale constraint with no opt-in or documented justification, which can violate organizational language-choice policies.
Content
No source excerpt is available for this finding.
Natural-Language Policy Violations
Low
Category
Not specified by scanner
Confidence
96% confidence
Finding
The module docstring, CLI description, argument help text, and user-facing status messages are all presented only in Chinese. This imposes a specific language on users without opt-in or an explanation that the tool is intentionally region-specific.
