Security audit

Cn Web Screenshot

Security checks for vulnerabilities and agentic risk

Overview

This is a coherent webpage screenshot skill, but it gives users unrestricted network fetch and file-write control without enough scoping or safety disclosure.

Install only if you are comfortable with the skill making outbound requests from the agent environment and saving screenshots to caller-selected paths. Avoid using it on internal, localhost, metadata, authenticated, or confidential URLs, and prefer running it in an isolated environment with a restricted output directory and pinned dependencies.

A.I.G

Vulnerability Patterns

Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions

Findings (3)

T05 · Unauthorized Access and Privilege Escalation

Error

Location: scripts/web_screenshot.py:29
Finding: Unrestricted URL Access Enables Server-Side Request Forgery
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/web_screenshot.py:42
Finding: Caller-Controlled Screenshot Path Permits Arbitrary File Overwrite
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: SKILL.md:8
Finding: Unpinned Playwright and Chromium Dependencies Create Supply-Chain Risk
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (4)

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The trigger phrases are broad and include common user language such as '帮我截图' and generic requests to capture a page, which can cause the skill to activate in contexts the user did not clearly intend. In a tool that performs outbound web requests and captures rendered page content, unintended invocation can lead to accidental access to sensitive internal URLs or screenshots of confidential pages.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The skill documentation does not warn users that taking a screenshot causes the local environment to make a request to the supplied URL and render its contents, which may expose internal endpoints, authenticated pages, or sensitive on-screen data in the resulting image. This omission is especially relevant because the skill supports arbitrary URLs and saving screenshots to disk, increasing the chance of capturing confidential content without informed consent.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The file's title, docstring, and user-facing error text are written only in Chinese, which imposes a specific language on users. Under the stated policy, forcing a specific language without offering user choice is a natural-language policy violation.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 88% confidence
Finding: This Python code file performs a network operation via page.goto(url, ...), which causes the local environment to contact a remote host. Aside from the terse Chinese docstring saying it captures a webpage screenshot, there is no confirmation prompt, logging, or explicit warning to the user that executing the skill will connect to the provided URL.
Content: No source excerpt is available for this finding.