T05 · Unauthorized Access and Privilege Escalation
Error
- Location
scripts/form-submit.js:30- Finding
Chromium Runs Without Its Security Sandbox
- Content
View full analysis
- Remediation
View remediation
Security audit
Web Form Automation
Security checks for vulnerabilities and agentic risk
Overview
This skill can help automate web forms, but it needs Review because it can reuse login sessions and submit arbitrary forms with weak safeguards.
Install only if you are comfortable with an automation helper that can act inside logged-in web sessions and submit forms. Use it only with session files you treat like passwords, verify the target domain before restoring a session, avoid payments/account changes/legal submissions unless you explicitly intend them, and prefer adding dry-run and confirmation checks before submit.
Vulnerability Patterns
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)
T09 · Insecure Skill Coding Practices
Error
- Location
scripts/form-submit.js:38- Finding
Session Storage Is Imported Without Verifying the Destination Origin
- Content
View full analysis
{ for (const [k, v] of Object.entries(data)) localStorage.setItem(k, v); }, session.localStorage); } if (session.sessionStorage) { await page.evaluate((data) => { for (const [k, v] of Object.entries(data)) sessionStorage.setItem(k, v); }, session.sessionStorage); } await page.reload({ waitUntil: 'domcontentloaded' }); } else { await page.goto(config.url, { waitUntil: 'domcontentloaded', timeout: 60000 }); } ``` ### Technical Analysis Web Storage is scoped to the origin of the currently loaded page. The script navigates to the independently configurable `config.url` and then inserts every key from the supplied `localStorage` and `sessionStorage` objects into that page's origin. The script does not record or verify the origin associated with the session file. If a legitimate session export is combined with an attacker-controlled URL, sensitive values from that export are deliberately placed into storage belonging to the attacker's origin. Cookie domain restrictions provide some protection for imported cookies because Chromium validates cookie attributes. They do not protect the copied Web Storage values. The empty cookie exception handler also suppresses ...[truncated 2134 chars]- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (6)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
The declared description presents a web automation skill centered on interacting with websites and submitting forms. The supplied code chunk does not perform any browser automation or website interaction at all. It only converts a local input image to an output file, apparently intended for webp compression, and reports file sizes. While image compression could be a supporting component of a larger upload workflow, this code chunk by itself does not implement the primary declared functionality and therefore materially differs from the stated purpose.
- Content
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - `form-submit.js` - Generic form submission template
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The activation language is very broad and can cause the skill to trigger for many generic website tasks, including sensitive account actions, uploads, or submissions. In an automation skill that can replay sessions, upload files, and submit forms, over-broad invocation increases the chance of unintended use on high-risk workflows.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
Recommending force-click on submit buttons without caution encourages bypassing UI checks that may intentionally prevent invalid, incomplete, or unreviewed submissions. In a form automation context, this can lead to unintended data submission, bypass of user-interface safety interlocks, and actions taken before the page is actually in a valid state.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The skill instructs loading cookies and localStorage/sessionStorage into a browser context without warning that these artifacts may contain bearer tokens, authentication state, and other secrets. This is dangerous because imported session material can enable account takeover-like behavior, cross-account actions, or leakage of sensitive credentials if mishandled.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The script will unconditionally click the configured submit button with force enabled, which can trigger irreversible actions such as account changes, purchases, uploads, or data submission without any final safety check. In a web-form automation skill, this is especially relevant because the explicit purpose is to interact with arbitrary websites, so misuse or operator error can cause real-world side effects immediately.
- Content
Static analysis
No suspicious patterns detected.