Security audit

sjht-web-screenshot

Security checks for vulnerabilities and agentic risk

Overview

The skill is a real screenshot tool, but it needs review because it weakens browser isolation and allows broad login/config-driven actions.

Install only if you are comfortable running it against trusted sites in a contained environment. Use a dedicated output directory, avoid real credentials in committed configs, restrict who can edit the JSON config, and treat storeLogin as a powerful app-state mutation feature rather than a simple screenshot option.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Error

Location: scripts/screenshot.js:34
Finding: Chromium Sandbox Disabled While Rendering Untrusted Web Content
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/screenshot.js:61
Finding: Output Path Traversal Through Unsanitized Screenshot Names
Content: View full analysis
saved ${p.name}.png`); ``` The same unsafe construction is used for other pages: ```javascript const filepath = path.join(outputDir, `${p.name}.png`); await capture(filepath); screenshots.push({ filename: `${p.name}.png`, name: p.name, path: p.path }); ``` The destination is passed to the screenshot operation without validation: ```javascript async function capture(filepath) { await page.screenshot({ path: filepath, fullPage: false }); } ``` ### Technical Analysis The `name` property originates in the supplied JSON configuration and is concatenated with `.png` before being passed to `path.join`. The code does not reject path separators, `..` components, or absolute-path-like values. `path.join` normalizes traversal components rather than enforcing confinement. For example, if `outputDir` is `/safe/output` and `p.name` is `../../tmp/target`, the resulting path can resolve to `/tmp/target.png`. An attacker who can influence the configuration can therefore direct the screenshot operation outside the intended output directory. Exploitation is constrained to paths writable by the account running the Skill, and the destination receives PNG screenshot data rather than attacker-selected arbitrary bytes. ### Attack Path 1. An attacker supplies or modifies the Skill configuration. 2. The attacker sets a page name to a traversal value, for example: ```json { "outputDir": "/s ...[truncated 1194 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (5)

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The example configuration embeds plaintext credentials directly in documentation, which normalizes insecure secret handling and increases the chance users will copy real passwords into files, logs, shell history, or version control. In a skill designed to access authenticated web apps, this creates a realistic path to credential exposure and unauthorized access.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The documented storeLogin feature expands the skill from passive screenshot capture into active in-page code execution against the target application's client-side state. Even though it is framed as a login workaround, invoking arbitrary store methods via CDP can trigger privileged actions, mutate application state, and bypass the narrower trust boundary users would expect from a screenshot tool.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: This code reads username and password values from the config and injects them into browser form fields, which is a sensitive-credential handling operation. Although there is a generic log message about logging in, there is no disclosure that the script consumes credentials from configuration or handles sensitive authentication data.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 85% confidence
Finding: The Pinia store login path programmatically calls a login method with configured arguments, which may include credentials or tokens. The console message describes the method call but does not clearly warn users that authentication secrets may be passed into the page context and used for login automation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 84% confidence
Finding: The documented selectors and page descriptions are written specifically for Chinese-language UI text, such as 请输入用户名 and Chinese result descriptions. There is no explicit user opt-in or note that this is just a locale-specific example, which can violate language/locale policy for a general-purpose skill.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.