T09 · Insecure Skill Coding Practices
Error
- Location
SKILL.md:56- Finding
Chromium Process Sandbox Disabled During Sensitive Mailbox Automation
- Content
View full analysis
- Remediation
View remediation
Security audit
Proton Mail
Security checks for vulnerabilities and agentic risk
Overview
This skill is for ProtonMail browser automation, but it includes bot-detection bypass and disables Chromium sandboxing while handling sensitive email access.
Review before installing. This skill can access and send mail from a ProtonMail account, asks users to provide credentials through environment variables, and includes automation-evasion settings plus disabled browser sandboxing. Use only on accounts you control, avoid privileged execution, pin dependencies, and remove stealth and no-sandbox launch arguments before use.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)
T08 · Insecure Dependencies
Warning
- Location
SKILL.md:6- Finding
Unpinned Playwright Dependency and Browser Installation
- Content
View full analysis
- Remediation
View remediation
``` 2. Provide a committed `package.json` and `package-lock.json`, then use: ```bash npm ci ``` 3. Review and update the pinned version through a controlled dependency-update process rather than resolving the latest release during installation. 4. Verify npm package provenance and lockfile integrity before installation. 5. Ensure the Chromium binary installed by Playwright corresponds to the reviewed, pinned Playwright release. 6. Perform dependency installation as an unprivileged user in an isolated build environment. 7. Avoid exposing ProtonMail credentials during dependency installation. 8. Consider disabling lifecycle scripts during initial package acquisition where compatible with the validated installation process, and explicitly review any scripts that must be enabled. ]]>
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (10)
Natural-Language Policy Violations
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The skill directly instructs impersonation of human browsing behavior by hiding automation fingerprints. This materially increases abuse potential because it is designed to evade detection by the service operator while automating access to a sensitive email platform.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The skill advertises login, inbox reading, sending, and mailbox management for an encrypted email service but does not prominently warn about privacy, account takeover, sending abuse, or compliance risks. In context, the skill handles highly sensitive communications, so underemphasizing risk makes misuse and unsafe deployment more likely.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 89% confidence
- Finding
This is a duplicate instance of the same unpinned
npx playwrightreference in the metadata. Unpinned package execution creates a supply-chain risk, especially in a skill that logs into ProtonMail and can access or send private email.- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 88% confidence
- Finding
The requirements section instructs
npx playwright install chromiumwithout binding the toolchain to an exact Playwright version. While the browser install itself is common, leaving the package version floating undermines reproducibility and increases supply-chain exposure.- Content
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
System Dependencies (Linux)
bash # Ubuntu/Debian sudo apt-get update sudo apt-get install -y libnss3 libnspr4 libatk1.0-0 libatk-bridge2.0-0 libcups2 libdrm2 libxkbcommon0 libxcomposite1 libxdamage1 libxfixes3 libxrandr2 libgbm1 libasound2 libpango-1.0-0 libcairo2 # Raspberry Pi / ARM
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
System Dependencies (Linux)
bash # Ubuntu/Debian sudo apt-get update sudo apt-get install -y libnss3 libnspr4 libatk1.0-0 libatk-bridge2.0-0 libcups2 libdrm2 libxkbcommon0 libxcomposite1 libxdamage1 libxfixes3 libxrandr2 libgbm1 libasound2 libpango-1.0-0 libcairo2 # Raspberry Pi / ARM
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
System Dependencies (Linux)
bash # Ubuntu/Debian sudo apt-get update sudo apt-get install -y libnss3 libnspr4 libatk1.0-0 libatk-bridge2.0-0 libcups2 libdrm2 libxkbcommon0 libxcomposite1 libxdamage1 libxfixes3 libxrandr2 libgbm1 libasound2 libpango-1.0-0 libcairo2 # Raspberry Pi / ARM
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The documentation explicitly includes bot-detection evasion measures such as disabling automation indicators and redefining
navigator.webdriverto impersonate human browsing. This is not necessary for ordinary mailbox automation and crosses into stealth behavior that can facilitate policy evasion, abuse of third-party services, and concealment of automated access.- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 88% confidence
- Finding
The troubleshooting guidance again uses
npx playwright install chromiumwithout a pinned version. Repeatedly encouraging floating package resolution increases the chance users execute unexpected code from the package registry.- Content
Context-Inappropriate Capability
Low
- Category
- Not specified by scanner
- Confidence
- 80% confidence
- Finding
The manifest only states browser-based email management functionality. The documentation adds a separate capability of sourcing credentials from process environment variables, which is credential-access behavior not declared in the skill description and may exceed the expected scope for a narrowly described mail-management skill.
- Content
Static analysis
No suspicious patterns detected.