Security audit

Pretext Reporter Bao

Security checks for vulnerabilities and agentic risk

Overview

The core text-measurement tool is coherent, but the package also ships under-disclosed browser automation and URL-controlled report posting that should be reviewed before installation.

Install only if you are comfortable with a skill that includes more than the public text-measurement API. The main functions look local and purpose-aligned, but avoid running the bundled Pretext browser-check or demo-server scripts unless you understand that they may open/control browsers, start local services, collect browser environment details, and post diagnostic reports to a URL supplied in the page query string.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (12)

Description-Behavior Mismatch

Medium

Confidence: 96% confidence
Finding: The page reads reportEndpoint from the query string and sends the generated report to that URL via fetch without origin allowlisting, authentication, or user consent. Because the report includes measurement results and environment metadata, any caller that can open this page with crafted parameters can exfiltrate data to an arbitrary destination, which exceeds a local diagnostic/reporting use case.

Context-Inappropriate Capability

Medium

Confidence: 89% confidence
Finding: The code collects a fairly rich browser fingerprint including user agent, DPR, viewport, and screen characteristics, then attaches it to the final report. For a text measurement tool this is broader than necessary and increases privacy risk, especially when combined with remote posting and detailed text/layout outputs.

Description-Behavior Mismatch

Medium

Confidence: 96% confidence
Finding: The page accepts a reportEndpoint from URL parameters and, if present, POSTs the generated report there without validating the destination or requiring an explicit user action. Because the report can include corpus content slices, diagnostics, and environment data, an attacker who can induce navigation to a crafted URL can exfiltrate local measurement results to an arbitrary external server.

Context-Inappropriate Capability

Medium

Confidence: 87% confidence
Finding: The code gathers a fairly detailed browser fingerprint, including user agent, DPR, viewport dimensions, screen metrics, and color/pixel depth, then attaches it to reports. While some environment data may help explain layout differences, this collection is broader than necessary for local text-layout diagnostics and becomes privacy-sensitive especially when combined with the remote reporting path.

Description-Behavior Mismatch

Medium

Confidence: 97% confidence
Finding: The page reads a reportEndpoint value from the URL query string and, in setReport(), POSTs the generated report JSON to that arbitrary destination. This creates a built-in exfiltration channel for measured text/layout diagnostics without user awareness, which is especially risky because the skill’s stated purpose is local text measurement/reporting rather than network reporting to untrusted endpoints.

Context-Inappropriate Capability

Medium

Confidence: 96% confidence
Finding: The fetch(reportEndpoint, { method: 'POST', body: JSON.stringify(report) }) call enables arbitrary outbound HTTP POST behavior controlled entirely by URL input. That capability is unrelated to the core rendering/measurement function and can be abused to send diagnostic contents, identifiers, and derived text information to attacker-controlled infrastructure.

Description-Behavior Mismatch

High

Confidence: 91% confidence
Finding: This file implements broad browser-automation and local server orchestration capabilities that go beyond simple text measurement/report generation. Even if intended for testing or rendering, these primitives can open browsers, navigate to attacker-controlled URLs, and launch local services, substantially expanding the skill's attack surface relative to its stated purpose.

Context-Inappropriate Capability

High

Confidence: 96% confidence
Finding: The code executes AppleScript via osascript and manipulates Safari/Chrome application state, including activating apps and controlling windows/tabs. This creates a powerful local automation channel that can drive user browsers without meaningful safety boundaries, enabling unexpected navigation, UI interference, or abuse if any upstream input becomes attacker-controlled.

Context-Inappropriate Capability

High

Confidence: 88% confidence
Finding: The file spawns Firefox and a Bun-backed local server as subprocesses, which gives the skill the ability to execute additional local programs and expose network services. While this appears intended to support automation, such capabilities are sensitive and exceed what users would normally expect from a text-layout reporting tool.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The code posts both detailed text measurement data and environment fingerprint information to a caller-supplied endpoint with no visible disclosure, confirmation, or permission check. In this skill context, the tool handles arbitrary input texts and diagnostic line content, so outbound transmission can leak user-provided or sensitive text alongside identifying browser metadata.

Missing User Warnings

Medium

Confidence: 97% confidence
Finding: The telemetry POST sends the full JSON report, which includes environment fingerprinting and potentially detailed text-layout diagnostics, to a URL supplied via the query string. There is no visible disclosure, confirmation, authentication, or origin restriction, so a crafted link can silently cause browser-side data transmission to an attacker-controlled endpoint.

Missing User Warnings

Medium

Confidence: 98% confidence
Finding: Report data is transmitted to a URL supplied in query parameters with no visible warning, confirmation, or disclosure to the user. Silent network transmission increases the likelihood of covert data leakage and makes it easy to weaponize links that cause the page to export analysis results when opened.

Static analysis

Detected: suspicious.dangerous_exec, suspicious.env_credential_access

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: pretext/scripts/accuracy-check.ts:196

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: pretext/scripts/browser-automation.ts:33

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: pretext/scripts/corpus-sweep.ts:247

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: pretext/scripts/gatsby-check.ts:5

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: pretext/scripts/gatsby-sweep.ts:5

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: pretext/scripts/accuracy-check.ts:70

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: pretext/scripts/browser-automation.ts:123