Chatgpt Image Generation

• Outcome: Pass
• Latest audit: Sep 11, 2026 · 4:56 AM UTC
• Version: 1.0.3

Overview

This skill is a straightforward ChatGPT browser-automation helper, with ordinary privacy and dependency cautions but no evidence of hidden or destructive behavior.

Install only in an environment where you are comfortable running Playwright and Chromium, and avoid submitting sensitive or regulated prompts unless your ChatGPT account and organization policies allow it. For stronger safety, pin Playwright with a lockfile and run the automation from an isolated browser/profile or disposable workspace.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:11

Finding

Unpinned Playwright Dependency and Browser Binary

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 11–12
Vulnerability Type: Unpinned third-party dependency and browser download
Risk Level: Medium

bash

npm install playwright
npx playwright install chromium

Technical Analysis

The documented installation process installs Playwright without specifying a reviewed version and then executes its CLI through npx to download Chromium. The project does not include a package manifest, committed lockfile, integrity hash, or other mechanism that fixes the installed dependency and browser artifacts to the versions reviewed during this audit.

As a result, the effective installation payload is mutable. A later Playwright release, compromised package distribution, or compromised browser artifact could introduce unsafe code after the skill itself has been reviewed. Package lifecycle behavior and the invoked Playwright CLI execute with the permissions of the user performing the installation.

This finding concerns supply-chain integrity. The audit found no evidence that the current project intentionally references a typosquatted package or that Playwright itself is malicious.

Attack Path

1. A user follows the prerequisite commands in SKILL.md.
2. npm install playwright resolves the dependency version available from the configured npm registry at installation time rather than a version fixed by this project.
3. npm downloads and installs that mutable package and may execute applicable package lifecycle behavior.
4. npx playwright install chromium executes the installed CLI and retrieves a browser binary.
5. If the package, registry response, distribution channel, or retrieved artifact has been compromised, attacker-controlled code can run under the installing user's account.

Impact Assessment

Successful exploitation could execute code with the privileges of the user installing the skill. Within that user's access scope, malicious dependency code could read or modify files, ...[truncated 375 chars]

Remediation

View remediation

Remediation Suggestions

1. Add a package.json that pins Playwright to a specifically reviewed version rather than relying on unconstrained resolution.
2. Generate and commit a package-lock.json, and instruct users to install with npm ci so dependency resolution is reproducible.
3. Configure CI to reject unexpected lockfile changes and to scan dependencies for known vulnerabilities.
4. Use a trusted npm registry and enable package provenance or signature verification where supported.
5. Pin the associated browser revision through the reviewed Playwright release and verify downloaded artifacts using trusted checksums or provenance metadata.
6. Prefer installation and execution in a least-privileged, isolated environment without unnecessary credentials or access to sensitive host files.
7. Document an explicit dependency-update review process before changing either Playwright or its browser artifacts.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill description omits a material privacy warning even though the workflow sends user prompts and generated content through the ChatGPT web service and explicitly states that login session data is saved for future runs. This can lead users to unknowingly expose sensitive prompts, generated outputs, or persisted authentication state, which is especially relevant for a browser-automation skill operating against a third-party web account.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 93% confidence

Finding

Using npx playwright without pinning a specific version can install and execute whatever version is current at runtime, which makes builds non-reproducible and increases supply-chain risk if an upstream release is compromised or introduces breaking behavior. In this skill, that risk is more meaningful because the tool is used to automate a logged-in browser session, so any malicious dependency execution could potentially access session context or local files available to the process.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.