T03 · Remote Payload Retrieval and Execution
Error
- Location
SKILL.md:41- Finding
Unverified Mutable Executable Download and Privileged System-Wide Installation
- Content
View full analysis
- Remediation
View remediation
Security audit
Obscura Skill
Security checks for vulnerabilities and agentic risk
Overview
This browser automation skill is coherent, but it asks users to install unverified latest binaries with elevated privileges and promotes stealth scraping workflows.
Review before installing. Prefer a pinned Obscura release with published checksums or signatures, install it in a user-local directory instead of using sudo, and use stealth or scraping features only on sites and systems where you have authorization and policy approval.
Vulnerability Patterns
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T08 · Insecure Dependencies
Warning
- Location
README.md:21- Finding
Unpinned Third-Party Package Execution During Skill Installation
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (20)
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The skill is designed to auto-trigger on broad, common web-related phrases such as web scraping, headless browser, JS rendering, and Playwright/Puppeteer. In practice this can cause the skill to activate in benign contexts and steer the agent toward stealth scraping or anti-detection guidance unexpectedly, increasing the chance of policy-violating or risky automation behavior.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The README promotes 'stealthy' and anti-detection browser automation without any warning about legal, contractual, or policy implications. In this context, the omission matters because the skill explicitly targets anti-bot and fingerprinting-evasion use cases, which can facilitate abuse or unauthorized scraping if presented without guardrails.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 93% confidence
- Finding
The README instructs users to run
npx skillswithout pinning a version, which causes execution of whatever package version is current at install time. This creates a supply-chain risk: a compromised or malicious future release could execute arbitrary code on the user's machine during installation.- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 70% confidence
- Finding
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The trigger description is broad enough to activate on many generic browser-testing or scraping requests, causing the agent to select a powerful web automation skill when a narrower or safer workflow might suffice. In this skill's context, that matters because the skill also promotes stealth, scraping, and automation against third-party sites, increasing the chance of misuse or unintended execution paths.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The skill explicitly markets defeating bot detection and recommending stealth builds without prominently warning about legal, policy, or site-operator risks at the point of use. In this context, stealth capabilities materially increase abuse potential by helping automate access to third-party sites while concealing automation indicators.
- Content
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
bash curl -LO https://github.com/h4ckf0r0day/obscura/releases/latest/download/obscura-aarch64-macos.tar.gz tar xzf obscura-aarch64-macos.tar.gz sudo mv obscura /usr/local/bin/ obscura --version
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
bash curl -LO https://github.com/h4ckf0r0day/obscura/releases/latest/download/obscura-aarch64-macos.tar.gz tar xzf obscura-aarch64-macos.tar.gz sudo mv obscura /usr/local/bin/ obscura --version
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
bash curl -LO https://github.com/h4ckf0r0day/obscura/releases/latest/download/obscura-aarch64-macos.tar.gz tar xzf obscura-aarch64-macos.tar.gz sudo mv obscura /usr/local/bin/ obscura --version
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 86% confidence
- Finding
The workflow-invocation guidance uses broad phrases like 'test the flow' and 'validate the page' that can match many normal frontend tasks, potentially causing over-selection of this skill. Because the skill includes instructions for browser automation, login flows, scraping, and stealth options, over-triggering increases the likelihood of unnecessary external interaction and risky automation behavior.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
md trap "kill $OBSCURA_PID 2>/dev/null || true" EXIT # Wait until the CDP server is reachable (max 5s) for i in {1..50}; do curl -s http://127.0.0.1:9222/json/version >/dev/null && break sleep 0.1 done USE_OBSCURA=1 npx playwright test "$@"
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 70% confidence
- Finding
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 70% confidence
- Finding
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 70% confidence
- Finding
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 70% confidence
- Finding
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 70% confidence
- Finding
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 70% confidence
- Finding
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
- Content
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 75% confidence
- Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- Content
md - Do **not** use Obscura against sites whose terms of service forbid scraping. - Do **not** disable `--obey-robots` on third-party sites in production pipelines without consent. - Do **not** treat stealth mode as a bypass for paywalls or auth — it only hides the fact that the browser is automated, not the fact that requests are made.
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The README provides the sole example user prompt in Portuguese ("Como faço scraping de uma SPA pesada de JavaScript?") without indicating that language choice is optional or user-selected. This can imply a locale preference in the skill documentation without user opt-in, which conflicts with the language/locale policy criteria.
- Content
Vague Triggers
Low
- Category
- Not specified by scanner
- Confidence
- 82% confidence
- Finding
The Portuguese shortcut phrases are broad natural-language triggers that can collide with ordinary requests to run tests, making this skill activate too aggressively. In isolation this is low severity, but in combination with scraping/stealth/browser-driving capabilities it can steer the agent toward higher-risk tooling without sufficient user intent verification.
- Content