Security audit

Renatus Icm

Security checks across malware telemetry and agentic risk

Overview

This is a real Renatus campaign-management skill, but it needs Review because it reuses live browser session tokens, handles bulk lead personal data, and includes destructive lead operations with incomplete guardrails.

Install only if you are comfortable giving the skill access to Renatus/Supabase campaign data and a dedicated browser session. Use a separate Chrome profile, keep CDP local-only, use least-privilege Supabase tokens, avoid production service_role keys for routine work, verify the unsubscribe backend before publishing the page, and treat exported CSV/JSON/log files as sensitive personal data.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
YARA SignaturesMalware Match, Webshell Match, Cryptominer Match
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (21)

Intent-Code Divergence

Low

Confidence: 89% confidence
Finding: The page safely uses textContent for most dynamic fields, but the company name is later populated via innerHTML replacement using config.company_name, which can come from URL parameters. If an attacker supplies HTML such as an image with an onerror handler in company_name, it can be injected into the navbar/footer and execute as DOM-based XSS. The event-registration context increases exposure because untrusted share links with attacker-controlled query strings are plausible.

Intent-Code Divergence

Medium

Confidence: 98% confidence
Finding: The page promises that the user has been removed from the mailing list and queued for deletion from the Renatus database, but the implemented logic only writes the email to localStorage and treats the backend deletion call as optional and ignorable on failure. This creates a deceptive privacy/data-handling flow where users are told deletion occurred even when no server-side unsubscribe or deletion happened.

Context-Inappropriate Capability

Medium

Confidence: 94% confidence
Finding: The script’s stated purpose is generating an email template, but in --event-url mode it injects JavaScript into an authenticated browser session, harvests session-derived auth material, and uses that access to call protected Renatus APIs. That creates a capability far beyond local templating and turns the tool into a browser-session scraper, which is dangerous because it can access account-scoped data without prompting for credentials or limiting scope to the minimum required.

Context-Inappropriate Capability

High

Confidence: 98% confidence
Finding: The code iterates browser contexts, opens pages, and checks localStorage for auth and XSRF tokens to locate a reusable authenticated session. Reusing tokens from an already logged-in browser bypasses normal authentication boundaries and can silently piggyback on a user’s active account, enabling unintended access to protected resources if the script is run in the wrong environment or repurposed.

Intent-Code Divergence

Medium

Confidence: 91% confidence
Finding: The script’s top-level description understates its behavior: it does not merely transform a pasted event URL into HTML, it also connects to a live browser debugging session and extracts authentication material from localStorage and cookies to call protected Renatus APIs. That mismatch is security-relevant because operators may run it without realizing it accesses active session tokens and authenticated account data, increasing the chance of unsafe use, token exposure through logs/debugging, or policy/privacy violations.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The script logs the user's email address to the browser console, exposing personally identifiable information to anyone with local browser access, shared-device users, debugging tools, browser extensions, or captured logs/screenshots. While not a direct remote compromise, it is unnecessary PII exposure and weakens privacy controls.

Missing User Warnings

Medium

Confidence: 89% confidence
Finding: The guide instructs operators to export bounced contacts with phone numbers for SMS follow-up, which repurposes contact data across channels without any mention of consent, lawful basis, or opt-out handling. In a marketing workflow, this increases the risk of privacy violations, non-compliant outreach, and contacting users who may already be disengaged or unreachable by email.

Missing User Warnings

Medium

Confidence: 83% confidence
Finding: The file documents commands that can delete leads individually or in bulk with an execution flag, but it does not warn that these actions are irreversible or require verification before use. In an operational marketing context, this creates a realistic risk of accidental mass deletion, loss of business records, and disruption of compliance/audit workflows tied to unsubscribe handling.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The guide instructs implementers to collect and transmit personally identifiable information including name, email, phone number, and source URL to a backend service, but it provides no guidance on user notice, consent, retention, or lawful handling of that data. In this context, the skill is an operational setup guide for a public registration page, so omission of privacy requirements can directly lead to noncompliant deployments and unnecessary exposure of personal data.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The workflow explicitly instructs operators to export lead records using an admin token and write names, emails, phone numbers, and session metadata to local CSV files. This creates a clear risk of credential exposure and bulk PII leakage through shell history, logs, local files, or insecure sharing, especially because no safeguards, retention guidance, or least-privilege controls are described.

Missing User Warnings

Medium

Confidence: 89% confidence
Finding: The bounce-recovery workflow directs staff to use phone numbers from lead data for SMS or WhatsApp outreach after an email bounce, but it provides no consent, opt-in, or privacy constraints. That can cause unauthorized contact, regulatory noncompliance, and misuse of personal contact data, particularly since the workflow operationalizes outreach from exported lead lists.

Missing User Warnings

Medium

Confidence: 84% confidence
Finding: The instructions describe using a live authenticated browser session and an --execute flag to perform real registrations in an external system, including support for remote CDP endpoints. Without strong warnings or guardrails, an operator can unintentionally make production changes, register the wrong person or sessions, or misuse an exposed browser-debugging interface tied to an authenticated account.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The script explicitly extracts authentication material from the user's live browser session (localStorage auth token, XSRF token, and cookies) and reuses it for authenticated API requests via a CDP-connected browser context. Even though the stated purpose is event scraping and no passwords are collected, this pattern handles high-value session secrets and can be abused if the script, its execution environment, or the target URL/input is modified, making it a genuine token-handling risk.

Missing User Warnings

Medium

Confidence: 82% confidence
Finding: The generated landing page collects personal data including first name, last name, email, and phone number, then sends it to a remote edge function, but the page text shown here provides only operational messaging and no meaningful privacy notice or consent language. This creates legal and security risk because users may submit PII without understanding who receives it, how it is processed, or where it is stored, especially since the endpoint is configurable and external.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The script intentionally reads authentication artifacts from localStorage and document.cookie inside an attached browser session and reuses them for authenticated API calls. In the context of an agent skill, this is more dangerous because it leverages remote debugging access to a live user session, which is highly sensitive and can be repurposed to access protected resources beyond the stated task if misused or modified.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: This script is explicitly designed to export lead records containing personal data such as names, emails, phone numbers, notes, and metadata into local CSV/JSON files. While that may be intentional functionality, it still creates a real privacy and data-handling risk because sensitive data is written in bulk to disk without any warning, consent check, minimization, or protective controls, increasing the chance of unauthorized local disclosure.

Missing User Warnings

Medium

Confidence: 89% confidence
Finding: The dry-run path prints personally identifiable information directly to stdout, including names, emails, phone numbers, and timestamps. Terminal output is often captured in logs, shell history, remote session recordings, or CI systems, so exposing PII there can leak data beyond the intended operator.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: The script persistently stores recipient email addresses in a JSON send log, creating unnecessary retention of personal data. If the workspace is shared, backed up broadly, or readable by other local users/processes, this can expose lead contact data and campaign history.

Missing User Warnings

Medium

Confidence: 83% confidence
Finding: The script stores unsubscribed email addresses in plaintext files under a local data directory, creating a privacy and data exposure risk if the host, backups, or logs are accessible to unauthorized users. These addresses are personal data, and the cron-oriented design increases the chance they accumulate over time without access controls or retention limits.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The automation accesses authentication-related localStorage entries from a browser session exposed over Chrome DevTools Protocol, which is credential-sensitive material. On a system where CDP is reachable or misconfigured, this design can facilitate session theft or unauthorized use of an already-authenticated administrative browser context.

YARA rule 'info_stealer': Information stealer patterns (credential harvesting, browser data theft) [malware]

High

Category: YARA Match
Content: - Rotate credentials after use; revoke tokens that were shared or exposed - Do not commit real credentials to `config.json` — use the `.example` file and environment variables **CDP access:** Scripts connect to `http://127.0.0.1:9222` to inspect your browser's localStorage/cookies for Renatus auth tokens. This requires Chrome/Brave launched with `--remote-debugging-port=9222`. The skill does not extract your master Renatus password from CDP — it reads existing session tokens only. --- name: renatus-icm
Confidence: 95% confidence
Finding: cookies for Renatus auth tokens. This requires Chrome

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

Detected: suspicious.exposed_secret_literal, suspicious.secret_argv_exposure

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: references/supabase-setup.md:31

Instructions pass high-value credentials through process argv.

Critical

Code: suspicious.secret_argv_exposure
Location: references/workflows.md:138