Security audit

Html2screenshot（长截图）

Security checks for vulnerabilities and agentic risk

Overview

The skill is related to HTML screenshotting, but it needs Review because it runs arbitrary active HTML in Chrome with sandboxing disabled and recommends a LAN-accessible background service without clear isolation or access controls.

Install only if you are prepared to run it in an isolated environment. Do not feed it sensitive or untrusted HTML unless Chrome sandboxing, network egress controls, a fresh browser profile, resource limits, and localhost-only authenticated service access are added or enforced externally.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Error

Location: run_baseline.js:34
Finding: Untrusted HTML Is Rendered with Chromium Sandbox Protections Disabled
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (35)

Tp2

High

Category: MCP Tool Poisoning
Confidence: 85% confidence
Finding: Mixing characters from multiple Unicode scripts in a single identifier is a common technique to create visually ambiguous tool names.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: The code is related to HTML-to-screenshot generation, so its general domain matches the description. However, the declared purpose says it can convert arbitrary HTML from file path, URL, or HTML string into a full long screenshot. This code does not expose such a general capability: it only processes hardcoded local dataset files under specific training/validation folders, and there is no support for URL input or direct HTML-string input from a caller. Its primary behavior is running a baseline batch test harness, not serving as a general screenshot skill triggered by the listed phrases. Therefore the description materially overstates and misrepresents the actual behavior shown in this code chunk.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: This markdown file defines activation phrases, so vague-trigger review applies. The trigger list includes very generic phrases like "长截图" and "网页截图" without scope constraints or exclusion examples, which could cause the skill to activate for ordinary screenshot requests not specifically about converting HTML into images.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 82% confidence
Finding: The manifest and trigger section describe multiple input types and broad screenshot behavior, but they do not specify boundaries for invocation. Without constraints or negative examples, common phrases like "把网页转成图片" or "截取整个页面" may overlap with unrelated browsing or screenshot intents.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The skill instructs users to expose a local HTTP capture service at a specific LAN-reachable address and accept arbitrary HTML for rendering, but provides no privacy or isolation guidance. Rendering attacker-supplied HTML in a browser context can trigger network requests, local-service interaction, and unintended disclosure of sensitive page contents or metadata, especially if the service is reachable by other hosts on the network.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The description and evaluation dimensions are written entirely in Chinese, signaling a Chinese-only skill experience, but the file provides no indication that language choice is optional or that the skill is region-specific. Under the policy, forcing a specific language without user opt-in is a natural-language locale violation.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The dataset explicitly includes testing against external URL pages such as financial sites and Zhihu, but it does not warn that running these evaluations will initiate outbound network requests and may expose user IP, headers, cookies, or session state to third parties. In an agent skill context, this is risky because evaluators may run the workflow in an environment with authenticated browser state or sensitive network access, causing unintended data exposure or interactions with live services.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The script renders arbitrary HTML with Puppeteer via page.setContent(), which can cause the browser to fetch external resources such as images, fonts, scripts, iframes, or tracking endpoints embedded in the HTML. In a skill whose purpose is to convert user-supplied HTML/URLs into screenshots, this can leak network metadata, reach internal services if not sandboxed, and create SSRF-like behavior unless outbound requests are constrained or disclosed.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The page title, headings, descriptions, and warning note are presented in Chinese throughout the file, with no indication that the skill is region-specific or that users can select another language. This is a natural-language policy issue because it imposes a specific locale on users without opt-in or justification.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 93% confidence
Finding: Natural-language policy review applies to all file types. The user-facing description, invocation wording, and usage guidance are presented only in Chinese, with no indication that other languages are supported or that Chinese-only behavior is an intentional, documented regional constraint.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 95% confidence
Finding: This shell script includes user-facing comments and console output in Chinese, such as the startup, progress, and completion messages. Under the policy rule, forcing a specific language without opt-in is a natural-language policy violation unless the locale constraint is clearly documented and justified, which is not present here.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 84% confidence
Finding: The embedded evaluation script writes PNG output to a caller-supplied filesystem path without any warning that executing the workflow will create or overwrite local files. While expected for screenshot generation, omission of this warning can still lead to accidental modification of local data, especially when the script is reused by automation or agents that derive paths from upstream inputs.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 73% confidence
Finding: The script saves generated PNG files to test-data/output using fs.writeFileSync, which is a file write operation covered by this rule. Although the purpose appears to be baseline generation, the code does not include any comment or warning that image files will be created on disk.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The HTML document declares lang="zh-CN", which sets a specific language/locale for the page. Under the policy criteria, forcing a specific locale without user opt-in or a documented justification can be a natural-language policy violation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The document sets lang="zh-CN", and all visible text is written in Simplified Chinese. Under the policy, forcing a specific language or locale without user opt-in can be a natural-language policy violation unless the locale restriction is clearly justified.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The document declares lang="zh-CN", and all visible UI text is presented only in Chinese. Under the policy, forcing a specific language or locale without user opt-in can be a natural-language policy violation unless the locale restriction is explicitly justified.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The file sets lang="zh-CN" and all visible user-facing text is in Chinese, which imposes a specific language/locale on users. The file does not indicate that this locale is optional, user-selected, or required for a region-specific purpose.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The document declares lang="zh-CN", indicating a fixed Chinese locale, and all visible UI text is presented only in Chinese. For this file type, natural-language policy review should flag language constraints when no user opt-in or justification is provided.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The HTML document declares lang="zh-CN", and all visible UI text is presented in Chinese. Under the policy, forcing a specific language without user opt-in can be a natural-language policy violation unless the locale restriction is explicitly justified.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The HTML root sets lang="zh-CN", and the entire report content is presented only in Chinese, with no indication that users can choose another language or that the file is intentionally limited to a China-specific audience. Under the stated policy, forcing a specific language/locale without opt-in is a natural-language policy concern.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The document sets lang="zh-CN", and the page title/body content are entirely in Chinese, which indicates a fixed language choice. Under the policy, forcing a specific language without user opt-in or a documented regional justification is a natural-language policy violation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The document declares lang="zh-CN", which hard-codes a specific language/locale for the page. Under the policy rules, forcing a locale without user opt-in or documented justification is a natural-language policy concern.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The document declares lang="zh-CN", and all visible content is written in Simplified Chinese, which indicates a fixed language/locale choice. Under the policy, forcing a specific language without user opt-in or clear justification is a natural-language policy concern.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The document declares lang="zh-CN", and all visible user-facing content is presented only in Chinese. Under the policy, forcing a specific language or locale without offering user choice can be a natural-language policy violation when no justification or opt-in is provided.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The HTML root sets lang="zh-CN", and the visible content is entirely Chinese, which indicates a fixed language/locale choice. The file does not provide any user opt-in, alternative locale, or justification that the page is intentionally region-specific.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.