Security audit

Lightpanda

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent Lightpanda browser-automation guide, but it tells agents to install and run unpinned browser binaries and configure automation with too little user control and safety guidance.

Review this carefully before installing. Use only if you trust Lightpanda and the publisher, prefer a pinned release over nightly, verify checksums or signatures where available, avoid letting an agent run the install automatically, keep the server bound to localhost, disable telemetry if needed, avoid hardcoding tokens or proxy passwords, and only crawl sites you are authorized to access.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (8)

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The skill encourages downloading and running a third-party browser binary, launching an automation server, and fetching arbitrary web content, but it does not warn about the security implications of executing untrusted binaries, exposing a control interface, or rendering hostile pages. In an agent context, this can lead to local system impact, sensitive data exposure, or abuse of the browser as a network-capable execution surface.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The guide explicitly labels shell commands as 'AI 可自动执行' while instructing users or agents to download a nightly binary from the internet, mark it executable, and run it, without integrity verification, provenance checks, or a warning about system changes. This is dangerous in an agent context because it encourages unattended execution of unpinned remote code, increasing supply-chain and remote code execution risk if the release artifact or distribution path is compromised.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The documentation directs users to run 'sudo mv lightpanda /usr/local/bin/' without warning that it performs privileged filesystem modification. In an agent-driven workflow, this can cause unauthorized persistent system changes or overwrite existing binaries if executed automatically or with elevated permissions.

Missing User Warnings

Medium

Confidence: 85% confidence
Finding: The MCP/AI examples encourage an agent to visit third-party sites and extract content without warning about privacy, authorization, robots/terms-of-service, or the possibility of sending sensitive prompts/URLs through an automated browsing tool. In an AI-agent context, this increases the chance of unintended data collection, external request execution, and scraping of sites without appropriate user review or policy controls.

Missing User Warnings

Low

Confidence: 88% confidence
Finding: The guide discloses only later that telemetry is enabled by default, after earlier quick-start steps instruct users to run the tool. This can lead users to unknowingly transmit usage metadata before they have an opportunity to opt out, which is a privacy and compliance concern, especially in enterprise or regulated environments.

Missing User Warnings

Medium

Confidence: 89% confidence
Finding: The examples include inline proxy credentials and an Authorization bearer token in documentation without any warning that these values are secrets. In an agent or automation context, users may copy these patterns directly into scripts, shell history, logs, or version control, leading to credential disclosure and unauthorized access.

Missing User Warnings

Medium

Confidence: 83% confidence
Finding: The batch crawling section promotes high-volume concurrent scraping but omits safeguards around permission, robots/terms compliance, rate limiting, and impact on target infrastructure. In an AI-agent setting, this can normalize potentially abusive collection behavior and increase legal, privacy, or service-disruption risk.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The guide tells users to remove the macOS quarantine attribute from a downloaded binary, which disables a built-in platform safety control intended to warn about unverified software. While this may be a legitimate workaround for unsigned releases, presenting it without any warning or verification step encourages users to bypass OS trust checks and could normalize running tampered binaries.

Static analysis

No suspicious patterns detected.