Ffagen Minimax Vision Scraper

• Outcome: Review
• Latest audit: Sep 16, 2026 · 5:22 AM UTC
• Version: 1.0.0

Overview

This skill matches its stated scraping purpose, but it uploads webpage screenshots to MiniMax and weakens browser protections in ways that need review before install.

Install only if you are comfortable with webpage screenshots and prompts being sent to MiniMax. Do not use it on logged-in pages, internal dashboards, localhost/private-network services, or pages containing secrets. The embedded API key should be removed or rotated, and the browser should be run with normal sandboxing and stricter URL/output-path controls before routine use.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (4)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/screenshot.js:16

Finding

Hardcoded MiniMax API Credential

Content

View full analysis

`. 4. Requests consume the credential owner's quota and may access any API capabilities granted to that token. 5. Abuse continues until the exposed credential is revoked. ### Impact Assessment An attacker can impersonate the credential owner to the extent permitted by the MiniMax token. Potential consequences include unauthorized API usage, quota exhaustion, financial charges, service disruption, and exposure of account-associated API functionality. This does not directly grant operating-system privileges. ]]>

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/screenshot.js:86

Finding

Unrestricted Browser Target Enables Visual SSRF and External Disclosure

Content

View full analysis

{ const imageBuffer = fs.readFileSync(imagePath); const base64Image = imageBuffer.toString('base64'); const mimeType = 'image/png'; const payload = { prompt: prompt, image_url: `data:${mimeType};base64,${base64Image}` }; const body = JSON.stringify(payload); const options = { hostname: API_HOST, port: 443, path: API_PATH, method: 'POST', headers: { 'Authorization': `Bearer ${API_KEY}`, 'Content-Type': 'application/json', 'Content-Length': Buffer.byteLength(body) } }; const req = https.request(options, (res) => { // Response handling omitted. }); req.on('error', reject); req.write(body); req.end(); }); } ``` ### Technical Analysis The command-line URL is passed directly to Playwright without validating its scheme, hostname, resolved address, port, or redirect destination. The browser therefore attempts to access any location reachable from its execution environment, including loopback services and private network applications. The resulting viewport screenshot is read from disk, Base64-encoded, and transmitted to the configured MiniMax API host. This creates a visual SSRF and disclosure chain: content unavailable to an external attacker but visible to the host's browser can be rendered ...[truncated 1500 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/screenshot.js:24

Finding

Caller-Controlled Screenshot Path Allows Arbitrary File Overwrite and Deletion

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/screenshot.js:50

Finding

Chromium Sandbox Disabled While Rendering Untrusted Pages

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (16)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The documented purpose omits several materially sensitive behaviors: sending screenshots to an external API, using an embedded default API key, and creating/reading/deleting local screenshot files. That mismatch prevents informed consent and can cause sensitive webpage contents, credentials, or internal data rendered in the browser to be exfiltrated to a third party without the user realizing it.

Content

No source excerpt is available for this finding.

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 51)May include surrounding context.

md

node scripts/screenshot.js <URL> [prompt]

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 54)May include surrounding context.

md

node scripts/screenshot.js <URL> [prompt]

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 55)May include surrounding context.

md

node scripts/screenshot.js <URL> [prompt]

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 91)May include surrounding context.

md

node scripts/screenshot.js <URL> [prompt]

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 96)May include surrounding context.

md

node scripts/screenshot.js <URL> [prompt]

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 101)May include surrounding context.

md

node scripts/screenshot.js <URL> [prompt]

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 90% confidence

Finding

The skill advertises environment-variable use, including API-related configuration, but does not declare any tool scope or permissions boundary. In an agent ecosystem, missing scope declarations reduce transparency and can let users invoke a skill without understanding that it depends on sensitive runtime configuration and external-capable behavior.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill does not warn that webpage screenshots and prompts are sent to MiniMax for external processing, even though screenshots may contain personal data, session-specific content, or internal business information. In this context, the omission is especially risky because the tool is designed to capture rendered pages wholesale, increasing the chance of transmitting sensitive visible content to a third party.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill explicitly promotes anti-bot evasion features such as hiding automation fingerprints and waiting for Cloudflare checks, but gives no warning about legal, contractual, compliance, or account-risk consequences. This is security-relevant because the functionality is tailored to bypass access controls and detection mechanisms, which can facilitate unauthorized scraping or policy violations.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The header describes a screenshot plus vision scraper, but the implementation quietly adds anti-automation evasion and Cloudflare-specific handling that materially changes the risk profile. This mismatch reduces transparency for operators and reviewers, increasing the chance the tool is deployed for unauthorized scraping without informed consent or governance.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The script goes beyond ordinary browser automation and deliberately masks automation signals, disables browser security isolation features, and waits through Cloudflare checks. In the context of a scraping skill explicitly marketed as bypassing anti-bot protections, these behaviors facilitate circumvention of access controls and can be used to collect content from sites that are intentionally defending against automation.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The script reads the captured screenshot, base64-encodes it, and sends it to an external MiniMax API without any consent prompt, sanitization, or warning that page contents may leave the local environment. Screenshots can contain credentials, personal data, internal dashboards, or proprietary information, so silent third-party transmission creates a significant data leakage risk.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The descriptive and instructional text is entirely in Chinese, and the file does not indicate that this language choice is optional or region-specific. Under the stated policy, forcing a specific language without user opt-in can be a natural-language policy issue.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 95% confidence

Finding

The dependency is version-ranged with a caret (^1.59.1), which allows automatic installation of newer patch/minor releases rather than a fully fixed version. This creates a supply-chain risk: builds may become non-reproducible and could silently pull in a compromised or breaking upstream release. In a scraping/browser-automation skill that interacts with web content, dependency trust matters because Playwright is a high-privilege package that launches browsers and processes untrusted pages.

Content

Scanner excerpt · package.json (reported line 3)May include surrounding context.

json

{
  "dependencies": {
    "playwright": "^1.59.1"
  }
}

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The script hard-codes locale to 'zh-CN' and sets Accept-Language headers preferring Chinese, which imposes a specific language/locale behavior. There is no opt-in, configuration prompt, or documented justification showing this is a region-specific tool.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.