Security audit

gt-core-skill

Security checks for vulnerabilities and agentic risk

Overview

This Gumtree automation skill is mostly aligned with its stated purpose, but it gives a local bridge broad control over a logged-in browser session without enough scoping or safeguards.

Install only if you trust the publisher and are comfortable giving a local Chrome extension control over your logged-in Gumtree session. Treat message sending, favouriting, login/logout, and post-ad category selection as real account actions, avoid passing passwords in command-line history, and disable the extension when not actively using it.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (17)

Description-Behavior Mismatch

High

Confidence: 98% confidence
Finding: The bridge exposes a generic "evaluate" pathway that is far broader than the declared Gumtree automation scope. Even though tab targeting is limited to Gumtree pages, arbitrary JavaScript execution in the page MAIN world can read page data, interact with authenticated user state, trigger sensitive actions, and bypass any higher-level action restrictions the skill description implies.

Context-Inappropriate Capability

High

Confidence: 99% confidence
Finding: This code constructs and executes attacker-controlled expressions using Function(...) in the page's MAIN world, which is effectively arbitrary code execution inside any Gumtree page the extension opens. In an authenticated browser session, that can expose private messages, profile data, CSRF-protected actions available to page scripts, and enable unauthorized posting, favouriting, or message interactions.

Context-Inappropriate Capability

Medium

Confidence: 93% confidence
Finding: The extension requests the highly privileged Chrome 'debugger' permission even though the stated purpose is a Gumtree automation bridge for login, search, messaging, and favourites. The debugger API can inspect and control pages well beyond normal automation needs, increasing the blast radius for credential theft, session hijacking, data exfiltration, or abuse if the extension, local bridge, or localhost websocket channel is compromised.

Description-Behavior Mismatch

Medium

Confidence: 92% confidence
Finding: The CLI exposes `messages` and `detail-message` commands that can send Gumtree messages, but the declared skill description only mentions reading messages and starting flows, not outbound messaging. This creates a capability/manifest mismatch that can mislead downstream systems or users into authorizing a skill with greater external-action power than expected.

Description-Behavior Mismatch

High

Confidence: 97% confidence
Finding: This module does more than passively read messages: `_send_message_if_requested` invokes `_SEND_MESSAGE_JS`, which programmatically fills the textarea and clicks the send button. If the skill or its manifest is expected to provide read-only messaging access, this is a privilege/scope mismatch that can cause unauthorized outbound communication from the user's account. In the context of a real logged-in Gumtree browser session, that capability is especially sensitive because messages can contact third parties and create real-world consequences.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The documentation explicitly instructs use of a login command that accepts a username and password and describes authenticated actions, but provides no warning about handling sensitive credentials, account changes, or privacy implications. In an agent skill context, this increases the chance that users or downstream agents will pass real credentials into automation without informed consent or clear boundaries on what actions may be taken on their account.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The README documents commands that can send Gumtree messages on the user's behalf, but the warning language is limited to login requirements and shell-history exposure rather than emphasizing that these are outbound account actions. In an agent-skill context, that omission increases the risk of users or downstream agents triggering real communications without clear confirmation or understanding of the consequences.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The README describes favouriting listings and initiating the post-ad flow without clearly labeling them as account-modifying actions performed under the user's identity. Because this skill operates through a real browser session and authenticated Gumtree account, weak disclosure can lead to unintended state changes such as saved ads or starting a listing workflow.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: The skill supports sending messages to external Gumtree users, but the documentation does not prominently warn that this is outbound communication to third parties. In an agent setting, insufficient disclosure can lead to unintended contact, spam, social engineering, or reputational harm if a model sends messages without clear user authorization.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The login flow accepts raw username and password arguments on the command line, and the skill even notes they may appear in shell history, but it does not establish safe handling requirements or safer input methods. This creates a real credential exposure risk through shell history, process listings, logs, transcripts, and agent memory.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The extension connects to a local WebSocket service and blindly accepts commands, then returns results, with no authentication, origin binding, or user-visible indication. Any local process able to talk to that bridge could potentially drive the user's Gumtree session and harvest data through the extension without meaningful user awareness.

Missing User Warnings

High

Confidence: 98% confidence
Finding: Dynamic evaluation of arbitrary expressions without warning is not just a transparency issue; it is a direct code-execution primitive in the browser page context. In this skill, that is especially dangerous because the extension is meant to operate a real logged-in Gumtree session, so evaluated code can access and act on valuable account data and actions.

Missing User Warnings

Medium

Confidence: 82% confidence
Finding: The `login` command accepts a username and password directly with no warning, disclosure, or safer input handling guidance. In an agent-skill context, silent credential collection increases the risk of users providing sensitive credentials without understanding how they will be used, stored, or exposed in process arguments, logs, or tooling layers.

Missing User Warnings

Medium

Confidence: 89% confidence
Finding: The `messages`, `detail-message`, `detail-favourite`, and `post-ad` commands can send messages or modify account state, but the CLI provides no warning that these commands may perform external actions on a live user account. In a browser-automation skill, this can lead to unintended user-impacting operations if invoked by an agent or script without clear consent boundaries.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The code performs a state-changing action by clicking the Gumtree Favourite button without any built-in confirmation, approval gate, or visible user-consent check at the point of execution. In an agent/browser-automation context, this can cause unintended account actions if the agent is prompted ambiguously, invoked mistakenly, or abused to modify a user's saved listings without sufficiently explicit authorization.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The code can send a message immediately when a `message` argument is provided, without any user-facing confirmation or safety interlock in this file. In an agent skill operating a real marketplace account, silent automation increases the risk of unintended contact, spam, social engineering, or actions taken on ambiguous prompts. The danger is amplified because the side effect is external and irreversible once a recipient sees the message.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: `_build_readable_messages_result` assembles and returns full conversation threads, including message text, timestamps, and participant identifiers. These are private communications and may contain sensitive personal or commercial information; exposing them broadly to the agent layer without minimization or explicit disclosure increases privacy and data-handling risk. In a browser automation skill for a user's live account, this sensitivity is higher than generic page scraping.

Static analysis

Detected: suspicious.secret_argv_exposure

Instructions pass high-value credentials through process argv.

Critical

Code: suspicious.secret_argv_exposure
Location: CLAUDE.md:26

Instructions pass high-value credentials through process argv.

Critical

Code: suspicious.secret_argv_exposure
Location: README.md:70

Instructions pass high-value credentials through process argv.

Critical

Code: suspicious.secret_argv_exposure
Location: SKILL.md:66