network-request-twister

• Outcome: Review
• Latest audit: Jul 30, 2026 · 5:50 PM UTC
• Version: 1.1.0

Overview

This is a disclosed browser traffic interception tool, but it needs Review because it can capture and alter sensitive live web traffic with broad defaults and limited safety guardrails.

Install only if you intentionally need browser traffic interception. Use it on sites and accounts you own or are authorized to test, prefer an isolated launched browser profile, scope rules to exact hosts and paths, avoid real credentials or production sessions, and stop the background process when finished because it can expose or modify sensitive traffic while running.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (16)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence
• Finding: The skill clearly instructs the agent to launch Python scripts, attach to a browser via CDP, inspect network traffic, and modify live requests and responses, which are powerful shell and network capabilities. Because these capabilities are not explicitly declared, platform controls and user expectations may be bypassed, increasing the risk of silent traffic interception, credential/header exposure, and unintended active manipulation of web sessions.

Context-Inappropriate Capability

Medium

• Confidence: 90% confidence
• Finding: After attaching to a selected target, the code calls `close_browser()`, which appears to terminate the entire browser instance rather than limiting actions to the selected tab/session. In a skill specifically meant to observe or modify network traffic, this exceeds the least-privilege scope and can disrupt unrelated user tabs, sessions, and workflows; if connected to an existing browser, it could also cause denial of service or accidental loss of state.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The README advertises powerful traffic interception and content modification features, including header rewriting, response mocking, and script/HTML injection, without any visible warning about privacy, authorization, legal boundaries, or the risk of breaking site behavior. In a skill specifically designed to alter live browser traffic, omission of safety guidance increases the chance of misuse against third-party sites, accidental credential/header exposure, or unsafe testing on production systems.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The README advertises interception, response mocking, header/body rewriting, and script/HTML injection without any warning that these are safety-sensitive capabilities. In this context, users may be encouraged to alter live traffic or page content in ways that can expose credentials, bypass safeguards, or facilitate deceptive testing against real services, so the missing warning meaningfully increases misuse risk.

Vague Triggers

Medium

• Confidence: 92% confidence
• Finding: The trigger text is intentionally broad and says the skill should activate even when the user uses vague everyday phrasing, which increases the chance of the skill being invoked without informed intent. In this context, accidental activation is more dangerous because the skill can inspect requests, headers, cookies, and response bodies, and can also alter traffic and page content.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The skill description explains how to observe and modify browser traffic but does not prominently warn that this may expose sensitive data such as cookies, authorization headers, request bodies, and private API responses. In a skill whose primary purpose is interception and modification, missing user-facing warnings materially increases the risk of uninformed use and privacy/security harm.

Vague Triggers

Medium

• Confidence: 82% confidence
• Finding: The rule matches any URL containing the substring "analytics", which is broader than necessary and can unintentionally block unrelated requests whose paths, query strings, or domains happen to include that term. In a network-interception skill, overbroad matching increases the chance of unintended traffic manipulation and confusing downstream behavior, even if the apparent goal is simply to suppress tracking.

Missing User Warnings

Medium

• Confidence: 81% confidence
• Finding: This example actively rewrites live request cookies and URL query parameters, including setting a session cookie and forcing pagination values, but the description does not warn users that authentication state, analytics behavior, or server-side logic may be altered. In a network-interception skill, missing user-facing warnings increases the chance of accidental misuse against real sites and can lead to confusing, privacy-impacting, or security-relevant test behavior.

Vague Triggers

Medium

• Confidence: 91% confidence
• Finding: The rule matches any URL containing "/login" and forcibly rewrites username and password fields. In a network-tampering skill, that broad trigger can affect unrelated authentication flows, cause unintended credential submission, and normalize silent manipulation of login traffic beyond a narrowly scoped test target.

Vague Triggers

Medium

• Confidence: 85% confidence
• Finding: The body-append rule applies to any POST/PUT/PATCH request whose URL merely contains "/api/", which is overly broad for request mutation. In this skill's context, that can silently alter many state-changing requests, potentially breaking application logic, corrupting test results, or modifying sensitive operations unintentionally.

Missing User Warnings

High

• Confidence: 93% confidence
• Finding: The manifest describes modifying login credentials but provides no warning that requests will be tampered with during authentication flows. Because this skill is explicitly designed to intercept and rewrite browser traffic, lack of disclosure materially increases the risk of deceptive credential manipulation and accidental misuse against real accounts.

Missing User Warnings

High

• Confidence: 97% confidence
• Finding: The rule removes CSRF-related form fields from submissions without any warning, which is inherently dangerous because it interferes with a core web security control. In a request-modification skill, this capability is especially risky: it can be used to probe defenses, invalidate protection assumptions, or encourage unsafe tampering with live application traffic.

Missing User Warnings

Medium

• Confidence: 84% confidence
• Finding: The rule injects an Authorization header with a bearer token into matching outbound requests, which can cause requests to execute under an unintended identity. In a network-tampering skill, this is more dangerous because header injection is a primary capability and could be reused to mask authentication state, access protected APIs, or accidentally normalize unsafe credential handling patterns.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The code launches a browser with --remote-debugging-port enabled, exposing the Chrome DevTools Protocol on a predictable local port without any user-facing warning, consent flow, or additional access controls. In the context of a skill explicitly designed to intercept and modify browser traffic, this increases risk because any local process able to reach 127.0.0.1:9222 could potentially inspect pages, extract sensitive data, or manipulate browsing state.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: This observer intentionally captures and emits full request/response metadata, including request headers, POST bodies, and response bodies, directly to stdout. In the context of a network interception skill, that behavior is expected, but it still creates a real data-exposure risk because secrets such as cookies, authorization headers, session tokens, PII, and API payloads may be collected and logged without redaction or an explicit consent/sensitivity gate.

Known Vulnerable Dependency: pydantic — 4 advisory(ies): CVE-2021-29510 (Use of "infinity" as an input to datetime and date fields causes infinite loop i); CVE-2024-3772 (Pydantic regular expression denial of service); CVE-2021-29510 (Pydantic is a data validation and settings management using Python type hinting.) +1 more

High

• Category: Supply Chain
• Confidence: 64% confidence
• Finding: pydantic

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.