Visual QA

• Outcome: Review
• Latest audit: Sep 16, 2026 · 11:20 AM UTC
• Version: 1.0.0

Overview

The skill is a disclosed visual QA workflow with a local manifest validator; the main caution is a mutable npx install command, not hidden or malicious behavior in the artifact.

Before installing, consider pinning or otherwise verifying the installer and repository revision instead of relying on the latest npx resolution. Use synthetic screenshots where possible, keep real-account captures out of version control, and only enable fix mode when you intend the agent to edit project files.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: README.md:39

Finding

Unpinned npx Installation Command Creates a Mutable Supply-Chain Execution Path

Content

View full analysis

Vulnerability Details

File Location: README.md, line 39
Vulnerability Type: Unpinned third-party installer and Skill source
Risk Level: Medium

Vulnerable Code

markdown

1. Install the skill: `npx skills add AntreasAntoniou/visual-qa`.

Technical Analysis

The documented installation command invokes the skills npm package through npx without specifying a version or integrity constraint. Depending on the local environment and npm configuration, npx may download and execute the currently published version of that package. The command also identifies the Skill by a mutable repository name without pinning a release tag or commit.

Consequently, the effective installation code and installed Skill contents can change after this repository has been audited. Compromise of the npm package, its publisher account, the package registry resolution path, or the referenced repository could introduce code that was not present during this audit.

This is a supply-chain risk rather than evidence that the current repository contains malicious code. The audited Python validator itself has no third-party dependencies and no network or command-execution behavior.

Attack Path

1. An attacker compromises the npm package, its maintainer account, or another component governing resolution of the unpinned skills package.
2. The attacker publishes a malicious version under the version range implicitly selected by npx.
3. Alternatively, the attacker compromises the mutable AntreasAntoniou/visual-qa source and modifies the content retrieved by the installer.
4. A user follows the Quick Start instructions and runs npx skills add AntreasAntoniou/visual-qa.
5. npx retrieves and executes the attacker-controlled installer, or the installer retrieves attacker-controlled Skill content.
6. The malicious installation process executes with the invoking user's privileges.

Impact Assessment

Successful explo ...[truncated 576 chars]

Remediation

View remediation

Remediation Suggestions

• Pin the skills npm package to a reviewed, immutable version, for example by documenting an explicit package version rather than relying on the latest registry release.
• Pin the installed Skill to an immutable release or full commit digest instead of a mutable repository reference.
• Publish and document expected integrity hashes or signed release provenance where supported.
• Recommend installation with npm lifecycle-script protections where compatible, and document whether the installer executes package lifecycle hooks.
• In CI or managed environments, use an approved lockfile, internal registry mirror, or allowlisted package source.
• Document the exact trusted publisher, package name, version, repository commit, and verification procedure so users can confirm provenance before execution.
• Periodically review pinned versions and update them through an explicit security review rather than automatic latest-version resolution.

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (7)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · README.md (reported line 59)May include surrounding context.

md

## Reporting a vulnerability

Please use GitHub's private vulnerability reporting for this repository. Do not attach real screenshots, account data, access tokens, or private project adapters to a public issue.

## Screenshot boundary

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SECURITY.md (reported line 9)May include surrounding context.

md

## Reporting a vulnerability

Please use GitHub's private vulnerability reporting for this repository. Do not attach real screenshots, account data, access tokens, or private project adapters to a public issue.

## Screenshot boundary

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The declared description is about visual QA analysis of rendered interfaces and screenshots. The supplied code does not inspect images, render UIs, analyze accessibility, compare themes/breakpoints, or coordinate any experts. Instead, it parses a JSON manifest, validates required fields/types/uniqueness, enforces safe repository-relative image paths, and optionally confirms files exist on disk. That is a materially different primary purpose, so this is a clear mismatch.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The declared description promises a rendered-interface visual auditing capability centered on screenshot/UI review. The actual code does not inspect interfaces or images at all; it only tests a manifest-validation script for JSON schema correctness, safe repository-relative paths, duplicate detection, optional file existence checks, and CLI behavior. This is a materially different primary purpose, so the description does not accurately represent the code chunk.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 70% confidence

Finding

Without declared permissions the skill's intent is opaque and cannot be validated.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The default prompt contains a bare trigger phrase, "$visual-qa", without any visible gating, scope restriction, or explicit activation conditions. In agentic systems, underspecified triggers can cause unintended invocation, prompt routing ambiguity, or easy abuse by untrusted user input to activate the skill in contexts where screenshot capture/review was not intended.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.dynamic_code_execution

Dynamic code execution detected.

Critical

• Code: suspicious.dynamic_code_execution
• Location: tests/test_validate_manifest.py:19