WebSculpt: Browser Automation with Memory

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:19 AM UTC
• Version: 1.0.13

Overview

The skill is not clearly malicious, but it installs and updates an unpinned global tool that writes persistent agent skills and tells the agent to follow them automatically.

Install only if you trust the WebSculpt npm package and are comfortable with persistent agent skills being added globally. Prefer a project-local install, pin and review the exact websculpt version, and inspect generated lifecycle skill files before allowing the agent to follow them automatically, especially on machines with logged-in browser sessions or sensitive data.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Error

• Location: SKILL.md:85

Finding

Unpinned Third-Party Package Is Installed and Trusted Globally

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 85–123
Vulnerability Type: Supply-chain exposure through an unpinned npm dependency
Risk Level: High

Vulnerable Code

markdown

### 2. Install the CLI and the browser tool

```bash
npm install -g @playwright/cli@0.1.13 websculpt

@playwright/cli is the browser-automation dependency used during explore; install it together with the CLI.

If the global install fails due to permissions (e.g. EACCES), do not use sudo — sudo does not exist on Windows, and a sudo install leaves root-owned files in the npm global directory, breaking every later npm operation with permission errors. Use the npx fallback instead: prefix every subsequent websculpt command with npx -y websculpt@latest and every playwright-cli command with npx -y @playwright/cli@0.1.13 (including skill install and status below).

3. Install the lifecycle skills

bash

websculpt skill install --global

This command is idempotent; existing skills are skipped. A global install writes to .claude/skills/, .codex/skills/, and .agents/skills/ under the user's home directory — the host agent only needs to read one of them.

text

The installed content is subsequently trusted at lines 115–118:

```markdown
2. Read the corresponding installed skill file and strictly follow its protocol. Locate it by the scope reported by `skill status`: `installed global` means `.agents/skills/<skill-name>/SKILL.md` under the user's home directory (identical copies exist under `.claude/skills/` and `.codex/skills/`); `installed local` means the same path under the current project directory.
3. Within this session, whenever any websculpt skill's protocol calls for loading another websculpt skill (e.g. explore suggesting capture), likewise read that skill's installed SKILL.md file instead of relying on host triggering.
4. Do not ask the user to restart the session or restate the task; take over yourself.

The update flow also r ...[truncated 2753 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin websculpt to a specific, reviewed version in every installation and fallback command. Do not use @latest.
2. Verify package provenance and integrity before execution, such as through a trusted registry, npm provenance attestations, and expected package or tarball hashes.
3. Replace automatic npm update -g websculpt with an explicit upgrade process that reviews and approves a precise target version.
4. Where operationally possible, suppress npm lifecycle scripts during acquisition and only enable required scripts after review.
5. Install into an isolated, least-privileged environment rather than the user's global npm environment.
6. Require explicit user confirmation before global installation, updates, or writes to Agent skill directories.
7. Stage generated lifecycle skills in a temporary review directory. Validate their content and file destinations before copying them into .claude/skills, .codex/skills, or .agents/skills.
8. Do not automatically “strictly follow” newly generated instructions. Treat them as untrusted until their source, version, integrity, and contents have been verified.
9. Record the installed version and hashes so later status checks can detect unauthorized or unexpected changes.
10. Document a cleanup procedure that removes compromised package artifacts and generated skills from all three supported Agent directories.

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (7)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill directs global installation of packages and writes skill files into user home directories without an explicit upfront consent/impact warning. This is dangerous because it normalizes persistent system modification from a conversational skill, potentially surprising users and broadening the blast radius if the package or installed skills are malicious or compromised.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 90)May include surrounding context.

md

`@playwright/cli` is the browser-automation dependency used during explore; install it together with the CLI.

If the global install fails due to permissions (e.g. EACCES), do not use sudo — sudo does not exist on Windows, and a sudo install leaves root-owned files in the npm global directory, breaking every later npm operation with permission errors. Use the npx fallback instead: prefix every subsequent `websculpt` command with `npx -y websculpt@latest` and every `playwright-cli` command with `npx -y @playwright/cli@0.1.13` (including skill install and status below).

### 3. Install the lifecycle skills

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 85% confidence

Finding

The skill explicitly enumerates host-specific skill storage locations under the user's home or project directories and instructs reading installed skill files from them. While functional, this increases exposure of local environment structure and enables chained loading of additional untrusted instructions from those paths, which is risky in a bootstrapper that treats installed files as executable guidance.

Content

Scanner excerpt · SKILL.md (reported line 98)May include surrounding context.

websculpt skill install --global

text

This command is idempotent; existing skills are skipped. A global install writes to `.claude/skills/`, `.codex/skills/`, and `.agents/skills/` under the user's home directory — the host agent only needs to read one of them.

`--global` is the default here. If the user explicitly wants WebSculpt only inside one project, run `websculpt skill install` (without `--global`) in that project's root instead, which requires an existing `.claude/`, `.codex/`, or `.agents/` directory there.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 91% confidence

Finding

The skill tells the agent to determine the task stage, load additional installed skill files, and continue the user's task without further prompting. This grants broad autonomous authority to chain into more instructions from installed files, reducing human oversight exactly in a context that performs installation, routing, browser automation, and external information acquisition.

Content

Scanner excerpt · SKILL.md (reported line 117)May include surrounding context.

md

1. Identify the task's stage: acquiring external information → `websculpt-explore`; solidifying a validated path into a command → `websculpt-capture`; fixing or iterating a broken command → `websculpt-maintain`; organizing / migrating the command library → `websculpt-library`. Most tasks start with explore.
2. Read the corresponding installed skill file and strictly follow its protocol. Locate it by the scope reported by `skill status`: `installed global` means `.agents/skills/<skill-name>/SKILL.md` under the user's home directory (identical copies exist under `.claude/skills/` and `.codex/skills/`); `installed local` means the same path under the current project directory.
3. Within this session, whenever any websculpt skill's protocol calls for loading another websculpt skill (e.g. explore suggesting capture), likewise read that skill's installed SKILL.md file instead of relying on host triggering.
4. Do not ask the user to restart the session or restate the task; take over yourself.

## Update and Repair

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 80% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 129)May include surrounding context.

md

## Prohibited

- Do not run any install command before probing (`websculpt --version` / `websculpt skill status`).
- Do not reinstall when the CLI and skills are already healthy, and do not ask the user to restart the session; route and continue the task directly.
- Do not use sudo to work around npm global install permission errors; use the npx fallback instead.
- Do not hand-edit the four installed lifecycle skill files; they are refreshed exclusively via `websculpt skill install --force`.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 130)May include surrounding context.

md

- Do not run any install command before probing (`websculpt --version` / `websculpt skill status`).
- Do not reinstall when the CLI and skills are already healthy, and do not ask the user to restart the session; route and continue the task directly.
- Do not use sudo to work around npm global install permission errors; use the npx fallback instead.
- Do not hand-edit the four installed lifecycle skill files; they are refreshed exclusively via `websculpt skill install --force`.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 93% confidence

Finding

The skill instructs use of npx -y websculpt@latest as a fallback, which executes the latest remotely fetched package without version pinning. That creates a supply-chain risk: a compromised or malicious new release could be executed immediately in the user's environment, and this skill is specifically a bootstrap installer with permission to install tools and write files.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.