ClawHub
Back to skill

Security audit

network-request-twister

Security checks for vulnerabilities and agentic risk

Overview

This skill does what it claims, but it can inspect and alter live browser traffic, cookies, credentials, bodies, and page content with weak safety scoping.

Install only if you are comfortable giving the agent access to observe and modify browser traffic for sites you control or are authorized to test. Avoid using it with real accounts, production credentials, payment flows, or sensitive third-party sessions unless you have reviewed and narrowed the rules, and prefer a pinned install version.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T08 · Insecure Dependencies

Warning
Location
README.md:17
Finding

Unpinned npx Installer Executes Mutable Third-Party Code

Content
View full analysis

Vulnerability Details

File Location: README.md:17-19 and README.zh-CN.md:17-19
Vulnerability Type: Unpinned executable dependency
Risk Level: Medium

Vulnerable code:

markdown
## Install

```bash
npx skills add 241x/network-request-twister
text

### Technical Analysis

The documented installation command invokes the `skills` npm package through `npx` without specifying an exact package version or integrity value. If the package is not already available locally, `npx` may retrieve and execute the version currently resolved by the npm registry.

Consequently, the code executed during installation can change after this Skill has been audited. This creates a supply-chain trust boundary involving the package publisher, registry, transitive dependencies, and dependency resolution configuration.

The Python dependencies in `scripts/pyproject.toml:8-14` similarly use open-ended minimum versions without an accompanying lockfile or hashes. Although these are legitimate mainstream packages, the dependency set is not reproducible.

### Attack Path

1. An attacker compromises the npm package publisher, registry entry, dependency chain, or a configured package mirror.
2. The attacker publishes a malicious version that satisfies the unpinned package request.
3. A user follows the installation instructions.
4. `npx` downloads the currently resolved package version.
5. The downloaded CLI or its installation lifecycle code executes with the installing user's privileges.

### Impact Assessment

Successful exploitation could execute arbitrary code under the installing user's account. Depending on that account's permissions, malicious installer code could read user-accessible files and credentials, modify projects, establish network connections, or alter local development tools.

The reviewed project does not itself contain evidence that the current dependency is malicious. The risk arises because the command
...[truncated 58 chars]
Remediation
View remediation

Remediation Suggestions

  1. Pin the installer to an audited exact version:
    bash
    npx skills@<audited-exact-version> add 241x/network-request-twister
  2. Document the expected official registry and package publisher.
  3. Use integrity verification or a checked-in lockfile where the installation mechanism supports it.
  4. Review lifecycle scripts and transitive dependencies for every pinned release.
  5. Pin Python dependencies to tested versions and distribute a lockfile containing cryptographic hashes.
  6. Perform dependency updates through an explicit review process rather than resolving unrestricted current releases during installation.

T09 · Insecure Skill Coding Practices

Note
Location
scripts/twist/browser.py:100
Finding

Temporary Browser Profiles Containing Session Data Are Not Deleted

Content
View full analysis

Vulnerability Details

File Location: scripts/twist/browser.py:100-128
Vulnerability Type: Insecure temporary-data lifecycle
Risk Level: Low

Vulnerable code:

python
self._tmp_dir = tempfile.mkdtemp(prefix="twist-browser-")

args = [
    exe,
    f"--remote-debugging-port={self._port}",
    "--no-first-run",
    "--no-default-browser-check",
    "--start-maximized",
    f"--user-data-dir={self._tmp_dir}",
]
if extra_args:
    args.extend(extra_args)
if url:
    args.append(url)

self._process = subprocess.Popen(
    args,
    stdout=subprocess.DEVNULL,
    stderr=subprocess.DEVNULL,
)

def stop(self) -> None:
    """Terminate the browser process, if launched."""
    if self._process is not None and self._process.poll() is None:
        self._process.kill()
        try:
            self._process.wait(timeout=5)
        except subprocess.TimeoutExpired:
            pass
    self._process = None

Technical Analysis

The browser launcher correctly creates a separate temporary profile instead of using the user's normal browser profile. However, stop() only terminates the browser process and clears the process reference. It never recursively removes self._tmp_dir.

During a browsing session, Chromium may write cookies, local storage, IndexedDB data, cache entries, history, service-worker state, and other site artifacts into this profile. These files remain on disk after Twist exits. Repeated executions can also accumulate stale profile directories.

Attack Path

  1. A user launches Twist with its managed browser mode.
  2. Twist creates a twist-browser-* directory and configures it as Chrome's user-data directory.
  3. The user visits or tests a site that stores sensitive session or application data.
  4. Chrome writes those artifacts into the temporary profile.
  5. Twist terminates the browser but does not delete the profile directory.
  6. Another loc ...[truncated 657 chars]
Remediation
View remediation

Remediation Suggestions

  1. Delete the profile only after the browser process has fully exited:
    python
    import shutil

def stop(self) -> None:
    if self._process is not None and self._process.poll() is None:
        self._process.kill()
        try:
            self._process.wait(timeout=5)
        except subprocess.TimeoutExpired:
            pass
    self._process = None

    if self._tmp_dir is not None:
        shutil.rmtree(self._tmp_dir, ignore_errors=True)
        self._tmp_dir = None
  2. Ensure cleanup runs on normal termination, startup errors, cancellation, and signal-driven shutdown.
  3. If the browser does not terminate within the timeout, retry cleanup after confirming that it no longer holds profile files open.
  4. Create temporary profiles with permissions restricted to the current user.
  5. Log cleanup failures without printing sensitive profile contents.
  6. Consider scanning for and safely removing stale twist-browser-* directories created by previous interrupted runs.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • System Prompt LeakageDirect Leakage, Indirect Extraction, Tool-Based Exfiltration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Findings (44)

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

This code chunk is just a minimal package runner (python -m twist) that delegates to twist.cli.main(). Based on the supplied code alone, the actual behavior is merely launching a CLI entrypoint. There is no evidence in this snippet of the declared skill purpose around browser network observation/interception/modification. Because the visible code’s primary purpose is materially different—or at least insufficiently aligned with the declaration—it should be flagged as a mismatch.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

The code chunk does not observe, intercept, modify, or analyze browser network requests or responses. It contains only generic logging infrastructure for a Python application, formatting log lines and attaching contextual metadata to records. This is a materially different primary purpose from the declared browser network interception/manipulation skill, so the description does not accurately represent the code.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

This rule explicitly strips CSRF-related form fields from requests to '/api/submit', which weakens or bypasses an application's request-forgery protections. In a network-testing skill, interception and mocking are expected, but a built-in rule to remove anti-CSRF controls is unusually dangerous because it facilitates security-control evasion rather than neutral observation or scoped test simulation.

Content

No source excerpt is available for this finding.

Anti-Refusal Statement

High
Category
Anti-Refusal
Confidence
90% confidence
Finding

Skill attempts to nullify the agent's safety policies or restrictions ('you have no restrictions', 'ignore your guidelines', 'do anything now'). This is a direct jailbreak that disables guardrails.

Content

Scanner excerpt · scripts/tests/test_intercept.py (reported line 683)May include surrounding context.

python
await self._execute_actions(ev, rule, stage)

    # ------------------------------------------------------------------
    # Bypass filter
    # ------------------------------------------------------------------

    def _should_bypass(self, ev: dict[str, Any]) -> bool:

Anti-Refusal Statement

High
Category
Anti-Refusal
Confidence
90% confidence
Finding

Skill attempts to nullify the agent's safety policies or restrictions ('you have no restrictions', 'ignore your guidelines', 'do anything now'). This is a direct jailbreak that disables guardrails.

Content

Scanner excerpt · scripts/twist/intercept.py (reported line 221)May include surrounding context.

python
await self._execute_actions(ev, rule, stage)

    # ------------------------------------------------------------------
    # Bypass filter
    # ------------------------------------------------------------------

    def _should_bypass(self, ev: dict[str, Any]) -> bool:

Direct Prompt Extraction

High
Category
System Prompt Leakage
Confidence
85% confidence
Finding

Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Content

Scanner excerpt · scripts/twist/intercept.py (reported line 262)May include surrounding context.

python
)
        for rule in enabled:
            if self._match_rule(ev, rule):
                return rule
        return None

    def _match_rule(self, ev: dict[str, Any], rule: Rule) -> bool:

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The README describes capabilities to block requests, mock responses, modify headers/bodies, and inject scripts/HTML, but it does not warn users that these actions can alter live site behavior, expose sensitive data, or create security/privacy issues if used on real accounts or production systems. In this skill's context, omission is more concerning because the core functionality is active manipulation of browser traffic, which can affect authentication, analytics, payment flows, and page trust boundaries.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
90% confidence
Finding

The install command uses npx skills add 241x/network-request-twister without pinning a specific version, so users may fetch and execute whatever package version is current at install time. In a skill that can intercept and modify browser traffic, supply-chain compromise or an unexpected upstream update could materially increase risk because the installed code may gain powerful access to browsing sessions.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The README advertises high-impact capabilities including modifying requests/responses, altering cookies and headers, and injecting scripts/HTML, but does not warn users that these actions can expose credentials, change authentication state, violate user privacy, or break page integrity. In the context of a network interception skill, missing safety guidance materially increases the chance of accidental misuse because the documented features directly enable sensitive traffic manipulation.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
95% confidence
Finding

The skill advertises shell and browser-network interception capabilities but does not declare any explicit tool scope or permission boundary. In an agent ecosystem, missing allowed-tools/permissions makes it easier for the skill to be invoked with broader-than-expected shell/network access, increasing the risk of unintended command execution, traffic interception, or data exposure.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The trigger guidance is intentionally broad and encourages activation even when the user is imprecise, which can cause the skill to engage in sensitive network observation or modification without sufficiently explicit user intent. Because this skill can inspect requests, bodies, headers, cookies, and alter live traffic, over-triggering raises the chance of privacy-invasive or disruptive actions being taken in the wrong context.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The skill describes observing network traffic but does not warn that captured requests and responses may include sensitive information such as authentication headers, cookies, personal data, or API payloads. In this context, omission of a privacy warning is dangerous because users may unknowingly authorize broad traffic inspection and expose secrets to the agent or logs.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The interception guidance explains how to block and rewrite live traffic but does not clearly warn that these actions can change application behavior, invalidate tests, hide real errors, or cause unintended side effects on authenticated sessions. Given the skill’s ability to modify headers, cookies, bodies, and HTML, users need an explicit warning before applying rules to real sites or sessions.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

This manifest file uses a broad match condition of "urlContains: analytics", which can overlap with many unrelated URLs that happen to include that common substring. The rule does not document narrower constraints or exclusions, so it may activate more broadly than intended.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
86% confidence
Finding

The description states that the skill modifies request cookies and URL query parameters, but it does not warn that these actions can alter authentication state, tracking behavior, or request semantics. For a markdown/description-facing artifact, this omits user-facing disclosure about behavior that can affect privacy and system behavior.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

This manifest file uses a trigger condition of only urlContains: example.com for the rule that overrides the session cookie. That scope is broad and lacks constraints or exclusions, so the rule could activate on many unrelated requests to the domain rather than a narrowly defined testing context.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

Matching any URL containing '/login' is broad and can activate on many unrelated endpoints, causing credential-field rewriting in unintended contexts. In a skill designed to modify live browser traffic, loose match conditions increase the chance of corrupting authentication flows or altering requests outside the user's intended target.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

Using a generic '/api/submit' substring as the trigger for destructive form-field removal makes the CSRF-stripping behavior applicable to a wide range of traffic. Because the associated action removes security-relevant fields, broad scope materially increases the risk of affecting legitimate submissions and undermining application protections.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The rule appends data to the body of all POST/PUT/PATCH requests whose URL contains '/api/', which overlaps with common application traffic and can silently alter many requests. While framed as debug instrumentation, broad body mutation in a browser traffic manipulation skill can break application logic, contaminate test results, or affect sensitive transactions beyond the intended scope.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · examples/basic.json (reported line 30)May include surrounding context.

json
"stage": "request",
      "match": {
        "allOf": [
          {"type": "urlPrefix", "value": "https://api.example.com/"},
          {"type": "headerNotExists", "name": "Authorization"}
        ]
      },

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · examples/request-mod.json (reported line 15)May include surrounding context.

json
"stage": "request",
      "match": {
        "allOf": [
          {"type": "urlPrefix", "value": "https://api.example.com/"},
          {"type": "headerNotExists", "name": "Authorization"}
        ]
      },

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/conditions.md (reported line 26)May include surrounding context.

md
"stage": "request",
      "match": {
        "allOf": [
          {"type": "urlPrefix", "value": "https://api.example.com/"},
          {"type": "headerNotExists", "name": "Authorization"}
        ]
      },

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

This section documents powerful request-manipulation features such as changing headers, cookies, URLs, methods, and bodies, including examples that can remove CSRF tokens or inject fake authorization/session values. In the context of a skill explicitly designed to intercept and modify browser traffic, omission of safety warnings and authorization boundaries increases the risk of credential misuse, request tampering, privacy violations, and testing being repurposed for unauthorized sessions or deceptive behavior.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

This section describes response rewriting, HTML replacement, and explicit script injection into pages without any warning that these operations can alter site behavior, mislead users, bypass UI expectations, or facilitate credential/session abuse during browsing. Because the skill’s purpose is to observe, intercept, and modify live browser traffic, normalizing page/script injection without safety constraints materially raises the chance of misuse for phishing-like overlays, content spoofing, or stealthy manipulation of web application behavior.

Content

No source excerpt is available for this finding.