Convert-any-SaaS-application-into-an-Agentic-interface

• Outcome: Review
• Latest audit: Sep 16, 2026 · 3:46 AM UTC
• Version: 1.0.0

Overview

This skill matches its stated agent-integration purpose, but it gives agents broad activation, automatic remote installation, deployment, and backend-credential workflows that deserve careful review before use.

Install only if you are comfortable with an agent that can fetch code from GitHub, modify the local Python/browser environment, deploy services, publish public discovery files, and help wire real APIs or databases. Use an isolated project or container, pin and review the Agent-See repository before installation, avoid --break-system-packages, keep secrets in platform secret stores, and require explicit confirmation before deployment, production testing, or any state-changing backend action.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:32

Finding

Unpinned Remote Dependency Installation with System Package Protection Bypass

Content

View full analysis

Remediation

View remediation

" ``` 2. Prefer a signed, versioned release from a trusted package registry over installation from a mutable Git branch. 3. Verify release signatures, commit signatures, or package hashes before installation. 4. Record the approved version and integrity value in a lock file or deployment manifest. 5. Remove `--break-system-packages`; install the package exclusively in a dedicated virtual environment or isolated container. 6. Run installation and conversion using a least-privileged account without access to unrelated credentials. 7. Review the pinned package's build configuration and installation hooks before approving it. 8. Apply dependency scanning and periodically review upstream ownership, release provenance, and transitive dependencies. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:62

Finding

Shell Command Injection Through Unquoted User-Controlled Placeholders

Content

View full analysis

--output --verbose ``` Repeated maintenance occurrence: ```bash agent-see convert --output --verbose agent-see verify /proof/proof.json ``` ### Technical Analysis The skill defines `` as a user-supplied website URL, SaaS URL, or local file path. It also allows the user to choose ``. These values are shown as direct, unquoted substitutions in shell command templates. If an agent constructs a command string by replacing these placeholders and executes it through a shell, shell metacharacters such as command separators, substitutions, redirects, or newlines may be interpreted as syntax rather than data. Values beginning with a hyphen could also be interpreted as additional command-line options. Quoting alone does not address every form of option injection, and constructing shell command strings remains less safe than invoking the process with a structured argument array. The repeated maintenance command also appends a path suffix to an unquoted output directory, preserving the injection risk during later re-synchronization operations. ### Attack Path 1. An attacker supplies a crafted source value or output directory to the agent. 2. The value contains shell syntax, a newline, command substitution, or a malicious option sequence. 3. The agent substitutes the value into the documented command template without validation or structured argument handling. 4. The resulting command is passed to a shell. 5. The shell interprets the injected content as syntax or an additional command. 6. The injected command executes with the privileges and environment of the agent process. 7. The attacker can then access or modif ...[truncated 858 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• YARA Signatures: Malware Match, Webshell Match, Cryptominer Match

Findings (8)

Vague Triggers

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The invocation rules are extremely broad, including generic phrases like 'go live', 'deploy the server', 'connect to my database', providing a URL, and even proactive triggering after any pipeline step completes. That makes unintended activation likely, and in this skill unintended activation is dangerous because the skill then proceeds toward installation, deployment, publication, and backend connection actions.

Content

No source excerpt is available for this finding.

YARA rule 'agent_skill_remote_bootstrap_execution': Remote script or code download followed by execution/bootstrap installation [agent_skills]

High

• Category: YARA Match
• Confidence: 99% confidence

Finding

This is a remote bootstrap pattern: installing and executing code directly from a GitHub repository via pip install git+https://..., and elsewhere pairing it with runtime/environment installation. In a skill context, this is highly dangerous because it allows unreviewed upstream code to run on the host, can change system packages via --break-system-packages, and may be triggered by overly broad activation rules.

Content

Scanner excerpt · SKILL.md (reported line 34)May include surrounding context.

act generation. After every step, present the go-live status dashboard and proactively ask what's needed next. The conversion is the starting point, not the finish line.

Pre-flight (All Commands)

Before running any agent-see command:

1. Check if agent-see is installed:

   bash

   agent-see --version 2>/dev/null
   

2. If not installed, auto-install from the repository:

   bash

   pip install git+https://github.com/Danielfoojunwei/Convert-any-SaaS-application-into-an-Agentic-interface.git --break-system-packages
   

3. If Python 3.11+ is not available, install via uv:

   bash

   uv python install 3.11
   uv venv --python 3.11 .venv
   source .venv/bin/activate
   uv pip install git+https://github.com/Danielfoojunwei/Convert-any-SaaS-application-into-an-Agentic-interface.git
   

4. For website/SaaS URL conversion, Playwright is required:

   bash

   playwright install chromium
   

---

Part 1: Pipeline Skills

---

Skill 1: Convert Source

Transform

MCP Config Access

High

• Category: Agent Snooping
• Confidence: 90% confidence

Finding

Skill accesses MCP server configuration files (mcp.json). MCP configs contain server URLs, authentication tokens, and tool definitions — reading them allows the skill to discover and potentially abuse other tool integrations.

Content

Scanner excerpt · SKILL.md (reported line 306)May include surrounding context.

├── skills/ │ └── skill-name/ │ └── SKILL.md ├── .mcp.json (if runtime endpoint exists) └── README.md

text

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 487)May include surrounding context.

Docker (Local or VPS):

bash

cd <output-dir>/mcp_server
cp .env.example .env
# User fills in .env values
docker-compose up -d

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 488)May include surrounding context.

Docker (Local or VPS):

bash

cd <output-dir>/mcp_server
cp .env.example .env
# User fills in .env values
docker-compose up -d

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill instructs the agent to install software directly from a remote GitHub repository, install a Python runtime, create a virtual environment, and install Playwright on the host before every workflow. This exceeds normal document-generation behavior and can cause arbitrary code execution and system modification on the user's machine, especially because the repository is not pinned to a reviewed commit and --break-system-packages weakens host protections.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill directs package installation, Python runtime installation, virtual environment creation, and browser dependency installation without an upfront warning that the host will be modified. In context, this is especially dangerous because the commands can alter system state, fetch and run remote code, and create persistence without a separate user consent checkpoint.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The backend connection section guides the agent to wire generated code to real APIs or databases, modify server.py, request credentials, and potentially operate against production systems. This meaningfully expands scope from conversion/publishing into privileged system integration, creating risk of unsafe code changes, secret handling, and unintended access to sensitive data or state-changing operations.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.