T05 · Unauthorized Access and Privilege Escalation
Error
- Location
SKILL.md:10- Finding
Unrestricted Access to Local Identity and Payment Credential Files
- Content
View full analysis
- Remediation
View remediation
Security audit
Shopping in Sweden
Security checks for vulnerabilities and agentic risk
Overview
The skill is openly built to make online purchases, but it handles raw payment credentials and uses broad browser-control techniques in payment pages without enough scoping or safeguards.
Review carefully before installing. This skill should not be used with live payment cards unless you are comfortable giving the agent reusable card details and direct browser control over checkout frames. Prefer a version that uses tokenized or hosted payment, requires explicit approval before reading any private file, shows the final merchant/amount/address before payment, and removes hardcoded card data.
Vulnerability Patterns
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (4)
T05 · Unauthorized Access and Privilege Escalation
Error
- Location
references/cdp-click.md:1- Finding
Cross-Origin Payment Controls Bypassed Through Unrestricted Chrome DevTools Protocol Access
- Content
View full analysis
H',n)+mask s.send(hdr+masked) def ws_recv(s, timeout=4): results = [] s.settimeout(timeout) while True: try: h = s.recv(2) n = h[1]&0x7F if n==126: n=struct.unpack('>H',s.recv(2))[0] elif n==127: n=struct.unpack('>Q',s.recv(8))[0 ...[truncated 2912 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Error
- Location
references/cdp-click.md:154- Finding
Plaintext Payment-Card Number, Expiration Date, and CVC Embedded in Documentation
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Error
- Location
references/cdp-click.md:144- Finding
Payment Data Injected into CDP Targets Selected by Weak URL Substring Matching
- Content
View full analysis
({name:i.name,placeholder:i.placeholder})))'}) # Should return: number, expiry, cvc # Fill in card details (read from ~/Private/) type_into_input(s, "number", "4273 1800 0443 8968", 10) type_into_input(s, "expiry", "03/31", 20) type_into_input(s, "cvc", "991", 30) ``` ### Technical Analysis The payment iframe is selected when its URL contains the substring `stripe.com/v3/elements-inner-accessory`. The code does not parse and verify the complete origin, confirm HTTPS, validate the target's parent frame, bind the iframe to the approved top-level retailer, or confirm that it belongs to the transaction authorized by the user. The use of `next(...)` selects the first matching target. If multiple Stripe frames exist because of another open tab, a stale checkout, an attacker-induced frame, or a compromised merchant page, the code may inject card credentials into the wrong target. Verifying that fields named `number`, `expiry`, and `cvc` exist does not prove that the frame belongs to the expected merchant or transaction. Those field names can be reproduced by an unintended payment form. ### Attack Path 1. An attacker causes an additional matching payment target to be present in the browser, such as through a malicious page, compromised retailer content, or stale checkout. 2. The Skill enumerates all CDP targets. 3. The substring test identifies ...[truncated 810 chars]- Remediation
View remediation
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (12)
Context-Inappropriate Capability
Critical
- Category
- Not specified by scanner
- Confidence
- 100% confidence
- Finding
The code directly inputs card number, expiry, and CVC into Stripe fields, including hard-coded example values and instructions to read card data from private storage. In an unknown-purpose skill, this is a highly sensitive financial capability that could be used to process unauthorized transactions or facilitate payment credential misuse.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The skill instructs the agent to read sensitive local files containing recipient details and payment card data, but it does not present a clear warning or obtain explicit user consent for that access. Because these files contain high-value PII and financial data, silent access creates a substantial privacy and security risk even before any purchase is completed.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The skill directs the agent to use CDP WebSocket access and synthetic mouse events to interact with cross-origin payment iframes, effectively bypassing normal browser-tool restrictions. This is especially dangerous in a payment context because it enables automation of sensitive checkout actions without transparent, user-visible safeguards and expands the attack surface around payment credential handling.
- Content
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The document explicitly describes bypassing same-origin protections by attaching to cross-origin iframe targets over CDP and dispatching input into payment frames. That materially expands an agent’s ability to interact with third-party payment contexts in ways normal browser automation intentionally forbids, enabling unauthorized purchase flows, payment confirmation clicks, and abuse of trusted checkout surfaces.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The skill automates entry of highly sensitive financial data without warnings, consent requirements, masking expectations, or storage/handling constraints. Even if intended for testing, presenting this as routine automation normalizes unsafe handling of cardholder data and increases the chance of misuse or accidental exposure.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The trigger phrases are broad enough to activate on common shopping-related requests, which can cause the skill to engage high-risk behaviors such as reading local PII files and initiating purchases with insufficiently explicit intent. In a payment-capable skill, overbroad activation materially increases the chance of unintended data access or transaction flow initiation.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The skill claims user information is never shared with third parties, but its documented payment flow explicitly routes payment through third-party processors such as Klarna, Stripe, or Adyen. This creates a misleading privacy guarantee that could cause users to consent without understanding where their personal and payment-related data is actually sent.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The instructions target a button labeled "Betala köp" and assume a Swedish-language Klarna flow, but the document does not state that the skill is Swedish-locale-specific or provide an opt-in or alternative for other languages. This creates a natural-language locale constraint that is undocumented and effectively forced.
- Content
Internal Network Request
Medium
- Category
- Server-Side Request Forgery
- Confidence
- 70% confidence
- Finding
Code issues a request to a loopback, link-local, or private-range host. This can reach internal services not meant to be exposed and is a common SSRF pivot.
- Content
md import urllib.request # 1. Click "Betala köp" inside the Klarna iframe tabs = json.loads(urllib.request.urlopen('http://127.0.0.1:18800/json').read()) kustom = next(t for t in tabs if 'kustom' in t.get('url','') and 'template' in t.get('url','')) s = ws_connect(kustom['id'])
Internal Network Request
Medium
- Category
- Server-Side Request Forgery
- Confidence
- 70% confidence
- Finding
Code issues a request to a loopback, link-local, or private-range host. This can reach internal services not meant to be exposed and is a common SSRF pivot.
- Content
md import urllib.request # 1. Click "Betala köp" inside the Klarna iframe tabs = json.loads(urllib.request.urlopen('http://127.0.0.1:18800/json').read()) kustom = next(t for t in tabs if 'kustom' in t.get('url','') and 'template' in t.get('url','')) s = ws_connect(kustom['id'])
Internal Network Request
Medium
- Category
- Server-Side Request Forgery
- Confidence
- 70% confidence
- Finding
Code issues a request to a loopback, link-local, or private-range host. This can reach internal services not meant to be exposed and is a common SSRF pivot.
- Content
md import urllib.request # 1. Click "Betala köp" inside the Klarna iframe tabs = json.loads(urllib.request.urlopen('http://127.0.0.1:18800/json').read()) kustom = next(t for t in tabs if 'kustom' in t.get('url','') and 'template' in t.get('url','')) s = ws_connect(kustom['id'])
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 72% confidence
- Finding
The instruction references a fixed path
~/Private/用户个人信息.txt, which assumes a particular filename and language convention. The file does not indicate that users can choose or configure their preferred language or locale for such resources, creating a mild language-policy concern.- Content
Static analysis
No suspicious patterns detected.