Pinchtab Helper

• Outcome: Review
• Latest audit: Sep 11, 2026 · 7:37 PM UTC
• Version: 0.1.0

Overview

The skill is a coherent browser-control helper, but its installation and activation guidance give it high-impact access with weak safeguards.

Review this skill before installing. Use a dedicated browser profile, avoid logged-in or sensitive sites unless you trust PinchTab and its local service, prefer pinned and verifiable installation methods, and keep the service bound to localhost unless you have a clear token and network exposure plan.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (3)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:17

Finding

Unverified Remote Installer Executed Directly by Bash

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 17
Vulnerability Type: Remote payload retrieval and execution
Risk Level: High

Vulnerable Code:

bash

curl -fsSL https://pinchtab.com/install.sh | bash

Technical Analysis

This command downloads mutable content from an external URL and passes it directly to Bash without first saving, inspecting, or cryptographically verifying it. Although HTTPS protects the connection in transit under normal conditions, it does not establish that the script is immutable, audited, or identical to the version reviewed with this Skill.

The package does not provide a pinned installer version, checksum, digital signature, or local copy of the script. Consequently, control or compromise of the website, DNS resolution, hosting infrastructure, certificate issuance, or deployment pipeline could change the effective installer after this Skill has been reviewed.

Direct shell execution is not the minimum privilege or minimum-risk mechanism required for the declared browser-automation functionality. The document already identifies package-manager and container-based alternatives, so immediate execution of an unverified remote script is unnecessary.

Attack Path

1. An attacker compromises or gains control over the installer website or an associated delivery component.
2. The attacker replaces install.sh with a payload containing arbitrary shell commands.
3. A user or agent follows the documented installation instruction.
4. curl retrieves the attacker's current payload.
5. Bash executes the payload immediately without inspection or integrity verification.
6. The payload performs actions available to the account that ran the command, potentially including file modification, credential access, additional payload installation, or persistence.

Impact Assessment

The remote script receives the full operating-system privileges of the invoking user. It can acce ...[truncated 378 chars]

Remediation

View remediation

Remediation Suggestions

Remove the pipe-to-shell installation instruction. Prefer a trusted package distribution mechanism with an exact audited version.

If a standalone installer must be offered:

1. Download it to a local file rather than piping it into a shell.
2. Pin the installer to an immutable release URL.
3. Publish and verify a SHA-256 digest or, preferably, a signature tied to a documented release key.
4. Require inspection before execution.
5. Run it as a non-administrative user unless a specific privileged operation is documented and separately approved.
6. Document the files, services, network endpoints, and permissions the installer creates.
7. Fail closed if integrity or signature verification does not succeed.

A safer documented flow would separately download the installer, verify its release signature or checksum, and only then execute the verified local file.

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:20

Finding

Unpinned Global npm Package Installation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 20
Vulnerability Type: Insecure third-party dependency installation
Risk Level: Medium

Vulnerable Code:

bash

npm install -g pinchtab

Technical Analysis

The command installs the registry's currently resolved version of pinchtab rather than an exact audited release. npm packages may execute lifecycle scripts during installation, and a global installation places package-controlled files in a shared executable location available through the user's command search path.

Because neither a version nor a verified integrity value is supplied, the artifact installed in the future may differ from the one intended when the Skill was authored or audited. A compromised publisher account, registry entry, release pipeline, or newly published malicious version could therefore turn this instruction into a code-execution path.

Attack Path

1. An attacker compromises the package publisher or release pipeline, or publishes a malicious update under the existing package identity.
2. The unpinned command resolves the attacker-controlled package version.
3. npm downloads the package and may execute its installation lifecycle scripts.
4. The package installs globally and can modify files writable by the invoking account.
5. Subsequent calls to pinchtab execute the installed package code.

Impact Assessment

Installation scripts and the resulting executable operate with the invoking user's privileges. They can access user-readable files, environment variables, credentials, network resources, and user-writable executable locations. Global installation increases persistence and scope compared with a project-local dependency because the executable remains available across projects and sessions. The command does not itself request administrator access, so system-wide privileges depend on the npm configuration and privileges used by the operator.

Remediation

View remediation

Remediation Suggestions

1. Pin the dependency to a specific reviewed version, such as pinchtab@X.Y.Z.
2. Verify that the package name, publisher, release provenance, and registry metadata correspond to the intended project.
3. Validate the package's published integrity information before installation.
4. Prefer a project-local installation with a committed lockfile over a global installation.
5. Review package contents and lifecycle scripts before permitting them to execute.
6. Perform installation as a non-administrative user in an isolated environment.
7. Establish an update process that requires review before changing the pinned version.

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:23

Finding

Unpinned Container Image Executed from a Third-Party Registry

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 23
Vulnerability Type: Insecure third-party container dependency
Risk Level: Medium

Vulnerable Code:

bash

docker run -d --name pinchtab -p 127.0.0.1:9867:9867 pinchtab/pinchtab

Technical Analysis

The image reference does not specify an immutable digest or explicit version. Docker therefore resolves a mutable default tag, normally latest, whose contents can change without modifications to this Skill. The project provides no digest, signature-verification procedure, or publisher-validation guidance.

Binding the service to 127.0.0.1 appropriately limits direct remote network exposure. However, it does not establish the integrity of the code executed inside the container. The command also does not apply optional hardening such as a read-only filesystem, capability removal, process limits, or an explicit non-root user.

Attack Path

1. An attacker compromises the image publisher, registry account, image build pipeline, or mutable default tag.
2. The attacker publishes a modified pinchtab/pinchtab image.
3. A user follows the documented Docker command and retrieves the current image.
4. Docker starts the attacker-controlled image.
5. The malicious container code accesses resources available within the container, uses outbound network connectivity, consumes host resources, and exposes attacker-defined behavior through the localhost browser-control endpoint.

Impact Assessment

Direct host exposure is reduced because no host directory or device is mounted and the service port is bound only to localhost. Nevertheless, attacker-controlled code can operate within the container, communicate over the network, consume resources, and falsify or abuse the browser-control service exposed to local clients. Host compromise would require an additional Docker daemon, kernel, or container-runtime weakness not demonstrated by the reviewed files, so ...[truncated 59 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin a reviewed image using an immutable digest, for example pinchtab/pinchtab@sha256:....
2. Verify the image publisher and use signed-image verification where available.
3. Document a controlled process for reviewing and updating the pinned digest.
4. Preserve the existing loopback-only port binding.
5. Run as an explicit non-root user if supported.
6. Drop unnecessary Linux capabilities and enable no-new-privileges.
7. Use a read-only root filesystem with narrowly scoped writable temporary storage where compatible.
8. Apply CPU, memory, process, and network restrictions appropriate to the browser-automation workload.
9. Avoid mounting host files, credentials, devices, or the Docker socket into the container.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (8)

External Script Fetching

High

• Category: Supply Chain
• Confidence: 99% confidence

Finding

Using curl ... | bash executes remote code directly from the network without prior verification, which is a classic supply-chain and code-execution risk. In this skill context, it is especially dangerous because the skill is instructing users to install a browser-control tool that can then operate on local browsing sessions, so compromise of the installer could lead to full local code execution and browser/session theft.

Content

Scanner excerpt · SKILL.md (reported line 17)May include surrounding context.

1. 安装 PinchTab（需要先安装）：

   bash

   # macOS / Linux
   curl -fsSL https://pinchtab.com/install.sh | bash
   
   # 或 npm
   npm install -g pinchtab
   

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 99% confidence

Finding

The | bash construct chains untrusted network content directly into shell execution, removing an opportunity for user review and magnifying the impact of a compromised server, CDN, DNS, or TLS-terminating component. Because this skill facilitates browser automation and references a local control service, a malicious installer could establish persistence, alter browser behavior, or exfiltrate credentials and page data.

Content

Scanner excerpt · SKILL.md (reported line 17)May include surrounding context.

1. 安装 PinchTab（需要先安装）：

   bash

   # macOS / Linux
   curl -fsSL https://pinchtab.com/install.sh | bash
   
   # 或 npm
   npm install -g pinchtab
   

Vague Triggers

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The trigger phrases are very broad and overlap with common requests such as browsing, searching, and opening websites, making accidental or unintended activation likely. In a browser-control skill, that can cause the agent to navigate to sites, interact with pages, and expose session or browsing data when the user did not explicitly consent to invoking this capability.

Content

No source excerpt is available for this finding.

Vague Triggers

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The trigger list is very broad and maps to common actions like opening a browser, browsing the web, searching, visiting websites, and operating a browser. This can cause the skill to activate for ordinary user requests beyond its intended scope, increasing the chance of unintended browser control, over-collection of web content, or unsafe automation being invoked without clear user intent.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

Nearly all user-facing instructions and trigger phrases are written in Chinese, with no indication that other languages are supported or that Chinese is a deliberate, documented locale constraint. This can constitute a language policy violation when the skill implicitly forces one language without user opt-in.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 75% confidence

Finding

Docker image references without a specific tag (:latest is implicit) or digest (@sha256:...) can be silently replaced by a malicious image.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill documents a local HTTP API and browser snapshots/actions, but does not clearly warn that browsing activity, page structure, and potentially sensitive page contents may be transmitted to a local service. This omission can mislead users about privacy and trust boundaries, especially because snapshots and interactions may include authenticated or sensitive pages.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The description is written entirely in Chinese and presents the skill in a way that assumes a Chinese-language context, but the manifest does not indicate that language selection is optional or that the skill is intended only for a Chinese-speaking locale. Under the stated policy, forcing a specific language without user opt-in can be a natural-language policy violation.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.