Security audit

office-quotes

Security checks for vulnerabilities and agentic risk

Overview

This quote skill is mostly related to its stated purpose, but it installs an unpinned global npm package and its API image mode renders untrusted remote SVG content in a local browser.

Review this before installing. The skill should pin its npm package version, document its actual CLI options, and avoid rendering remote SVG as active browser HTML. Prefer offline text mode, or run API image conversion only in an isolated environment with no secrets or sensitive local/network access.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

Location: SKILL.md:4
Finding: Unpinned Third-Party Package Installed Globally
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/office-quotes.js:91
Finding: Untrusted Remote SVG Rendered as Active Local HTML
Content: View full analysis
body { margin: 0; display: flex; justify-content: center; align-items: center; min-height: 100vh; background: #111827; } svg { max-width: 100%; height: auto; } ${svgContent} `; fs.writeFileSync(htmlPath, htmlContent); const browser = await playwright.chromium.launch(); const page = await browser.newPage({ viewport ...[truncated 3183 chars]
Remediation: View remediation
` and ``; - attributes beginning with `on`; - `javascript:` and `data:` URLs; - external `href`, `xlink:href`, CSS `url()`, font, image, and stylesheet references; - XML entities, DTD declarations, and unsupported namespaces. 4. Create the Playwright context with JavaScript disabled: ```javascript const context = await browser.newContext({ javaScriptEnabled: false }); const page = await context.newPage(); ``` 5. Intercept and abort all browser network requests except the initial local document, or render in a network-isolated sandbox. 6. Add a restrictive Content Security Policy such as `default-src 'none'; img-src data:; style-src 'unsafe-inline'`, adjusted only for resources proven necessary. 7. Validate `svgRes.ok`, require an expected SVG content type, and enforce strict response-size and processing-time limits. 8. Run Chromium as an unprivileged user in an isolated container with no secrets, sensitive mounts, or access to internal services. 9. Use randomly created, permission-restricted temporary directories and ensure cleanup occurs in a `finally` block. ]]>

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (7)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The declared behavior and the reported actual implementation diverge substantially: the skill claims offline quotes, API-backed metadata, and avatars, but may instead operate on local SVG files and generate PNGs. While this may stem from poor packaging or documentation rather than overt malice, the discrepancy undermines trust and can conceal undeclared local file access patterns in a context that should be low risk.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: The declared behavior and the reported actual implementation diverge substantially: the skill claims offline quotes, API-backed metadata, and avatars, but may instead operate on local SVG files and generate PNGs. While this may stem from poor packaging or documentation rather than overt malice, the discrepancy undermines trust and can conceal undeclared local file access patterns in a context that should be low risk.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: The declared behavior and the reported actual implementation diverge substantially: the skill claims offline quotes, API-backed metadata, and avatars, but may instead operate on local SVG files and generate PNGs. While this may stem from poor packaging or documentation rather than overt malice, the discrepancy undermines trust and can conceal undeclared local file access patterns in a context that should be low risk.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 82% confidence
Finding: The skill metadata declares no explicit tool scope or permissions, yet the described/package-backed behavior includes network access and likely file access for rendering/output. In an agent environment, undeclared capabilities reduce transparency and can allow a seemingly harmless quote skill to perform actions users and orchestrators did not approve.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 70% confidence
Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: In API mode, the script fetches remote SVG content from an external service, writes it to /tmp, and then renders it in a browser context via Playwright. Because SVG is active content and may reference external resources or browser-parsed constructs, this expands the trust boundary to unvalidated remote input; a compromised API or malicious response could trigger unintended network access, privacy leakage, or browser-engine exploitation during rendering. The skill context makes this more concerning because a fun quote generator would not normally justify quietly handling untrusted remote markup and local file rendering.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Low

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The header usage string documents --format png|jpg|webp, which implies SVG is not a supported output format. However, the implementation sets outputFormat = "svg" by default and explicitly handles svg as a valid format in both rendering and conversion paths.
Content: No source excerpt is available for this finding.

Static analysis

Detected: suspicious.browser_file_render

Browser automation renders interpolated SVG/HTML from a file URL with JavaScript enabled.

Critical

Code: suspicious.browser_file_render
Location: scripts/office-quotes.js:98