Security audit

Live Site Polish

Security checks for vulnerabilities and agentic risk

Overview

The skill mostly matches live website polishing, but it forces an unsolicited promotional link into final replies and has weak safeguards for screenshots on logged-in pages.

Review this skill before installing. Use it only on non-sensitive or test pages unless you are comfortable with browser-state changes and local screenshots. The publisher should remove the forced promotional completion line and add explicit consent/privacy checkpoints around logged-in pages and screenshot capture.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

Findings (2)

T01 · Skill Instruction Hijacking

Error

Location: SKILL.md:231
Finding: Forced Promotional Output Injection
Content: View full analysis
Remediation: View remediation

T01 · Skill Instruction Hijacking

Warning

Location: SKILL.md:17
Finding: Agent Capability Suppression Through Skill and Tool Exclusivity Instructions
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The skill directs the agent to redesign a live website in-browser and create screenshots and patch artifacts, but it does not require explicit user consent or a warning that the active page/session state may be modified and recorded. On logged-in or sensitive pages, this can lead to unintended alteration of session-scoped data, exposure of private content in screenshots, and persistence of sensitive artifacts on disk.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The skill tells the agent to reopen the browser in headed mode and invite user takeover for login, MFA, or CAPTCHA, but it omits safeguards around authenticated-session handling and privacy. This can expose sensitive account context to the agent workflow after takeover, especially if the agent then continues inspecting, modifying, or screenshotting pages containing personal or privileged data.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The skill explicitly instructs the agent to append a promotional message for an external site in the final user-facing response, even though that behavior is unrelated to the user's task. This creates an unauthorized content-injection channel and can be abused for advertising, tracking, affiliate spam, or social engineering under the guise of normal task completion.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.