Security audit

Web Profiler Bundle

Security checks for vulnerabilities and agentic risk

Overview

This skill appears to be a local profiling-notes logger, with privacy cautions but no evidence of hidden network access, credential theft, privilege escalation, or destructive behavior.

Install only if you want a local command-line logbook for profiling notes, not a full HTTP profiler. Do not enter tokens, cookies, credentials, private headers, or sensitive customer data, and review or delete ~/.local/share/web-profiler-bundle if you no longer need the retained logs or exports.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/script.sh:5
Finding: Profiling Data Is Stored Without Explicit Access Controls
Content: View full analysis
> "$DATA_DIR/history.log"; } ``` A representative command writes supplied profiling data into this directory without setting file permissions: ```bash local input="$*" local ts=$(date '+%Y-%m-%d %H:%M') echo "$ts|$input" >> "$DATA_DIR/run.log" local total=$(wc -l < "$DATA_DIR/run.log") echo " [Web Profiler Bundle] run: $input" echo " Saved. Total run entries: $total" _log "run" "$input" ``` ### Technical Analysis The script creates its data directory and log files using the invoking process's ambient `umask`. It does not set a restrictive `umask`, explicitly create the directory with mode `0700`, or ensure log files have mode `0600`. Consequently, environments with permissive defaults may create a directory accessible to other local users and logs that are group-readable or world-readable. The documentation encourages users to record HTTP routes, middleware behavior, database query details, configuration entries, and profiling results. Such records can contain internal endpoint names, identifiers, query text, infrastructure details, or credentials accidentally included in command input. This issue applies to `history.log` and the command-specific files, including `run.log`, `check.log`, `analyze.log`, `config.log`, and `report.log`. ### Attack Path 1. A user invokes the skill with sensitive profiling or configuration text. 2. The script creates `~/.local/share/web-profiler-bundle` and its log files under the user's current `umask`. 3. On a system with permissive default permissions, another local account traverses the directory and reads the log files. ...[truncated 701 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Note

Location: scripts/script.sh:133
Finding: Unescaped Multiline Input Permits Audit Log Forgery
Content: View full analysis
> "$DATA_DIR/history.log"; } ``` The command handlers preserve user-controlled line breaks and append the result directly to logs: ```bash local input="$*" local ts=$(date '+%Y-%m-%d %H:%M') echo "$ts|$input" >> "$DATA_DIR/run.log" local total=$(wc -l < "$DATA_DIR/run.log") echo " [Web Profiler Bundle] run: $input" echo " Saved. Total run entries: $total" _log "run" "$input" ``` The same vulnerable logging pattern is repeated across the `run`, `check`, `convert`, `analyze`, `generate`, `preview`, `batch`, `compare`, `export`, `config`, `status`, and `report` handlers. ### Technical Analysis The script combines command arguments into `input` and writes the value directly into line-oriented files. It does not reject or encode carriage-return and newline characters. A value containing embedded line breaks therefore produces multiple physical log lines even though it originated from one invocation. The injected lines can imitate timestamps or other legitimate records. This breaks the integrity of command-specific logs and `history.log`, which the documentation describes as an audit trail. It can also corrupt statistics and any later CSV, JSON, or text export that interprets each physical line as a separate entry. The issue is data injection rather than shell command injection: the input is quoted and is not evaluated as shell syntax. No arbitrary command execution is demonstrated. ### Attack Path 1. An attacker or untrusted automation obtains the ability to supply a command argument to the skill. 2. The attacker includes an embedded newline followed by text formatted as a legitimate log entry. 3. The script app ...[truncated 747 chars]
Remediation: View remediation
&2 exit 1 ;; esac ``` 2. Alternatively, encode records using a structured serializer that correctly escapes control characters. 3. Use `printf` instead of `echo` for predictable output: ```bash printf '%s|%s\n' "$ts" "$sanitized_input" >> "$DATA_DIR/run.log" ``` 4. Define a single logging function that validates and serializes all fields, then use it consistently in every command handler. 5. If JSON or CSV export is supported, use format-aware escaping rather than interpolating raw fields. 6. Add tests for newline, carriage-return, delimiter, quote, and backslash characters to verify that one invocation always creates exactly one logical record. ]]>

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (8)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The documented behavior presents this as an HTTP profiling tool, but the described functionality is actually a generic local logger that stores arbitrary user-supplied text and supports search/export/reporting over that stored data. This mismatch is dangerous because users may provide sensitive route, query, header, or diagnostic information under the assumption of purpose-limited profiling, while the skill persists that data to disk and broadens exposure through export and history aggregation.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

High

Category: Not specified by scanner
Confidence: 96% confidence
Finding: Branding and help text describe a specialized web profiler, while the code behavior is inconsistent with that claim and instead records arbitrary inputs. Deceptive or materially misleading functionality increases the likelihood that users will provide sensitive diagnostic content inappropriately, turning routine use into unintended local data collection.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The script presents itself as a web profiling tool, but the implemented behavior is a generic local activity logger that stores arbitrary user input. This mismatch is dangerous because users may trust it with debugging data, route details, tokens, URLs, or other sensitive strings under the assumption that it performs profiling rather than persistent collection.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The export functionality allows accumulated stored data to be written to JSON, CSV, or TXT files, but the documentation does not explicitly warn that this creates additional on-disk copies of potentially sensitive profiling content. That increases disclosure risk because exported files are easier to move, upload, commit, or share unintentionally than internal log files.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The skill explicitly states that all data is stored locally and maintained in per-command logs and a unified history, but it does not warn users that profiling inputs may contain sensitive operational data such as endpoints, query characteristics, or internal performance details. Persisting such data without a prominent warning increases the chance of accidental local disclosure, especially on shared systems or in environments where home directories are backed up or monitored.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The script creates a persistent data directory and appends user-supplied inputs and history to local files without any necessity tied to web request profiling. This creates a privacy and data-handling risk because sensitive operational details entered during debugging may be retained on disk indefinitely and later exposed to other local users, backups, or support bundles.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The export function aggregates all stored logs into new files on disk, increasing the persistence and spread of previously collected activity data. This amplifies exposure risk because sensitive entries become easier to copy, share, back up, or mishandle, especially when users are not warned that historical activity will be materialized into export artifacts.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: These command handlers persist user input to log files with no upfront disclosure that entered data will be stored. In the context of a purported debugging/profiling skill, operators may enter URLs, headers, credentials, query fragments, or internal system details that are silently retained and later exposed.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.