URL to PNG

• Outcome: Review
• Latest audit: Sep 10, 2026 · 5:07 PM UTC
• Version: 0.0.2

Overview

This skill does what it says, but it can render any supplied URL from the user’s machine and send the screenshot back, which creates an under-scoped internal-network data exposure risk.

Review this before installing if you run agents on a machine or network with private services. Use it only for trusted public URLs, preferably in a sandbox or container with restricted network access, and pin shot-scraper/Chromium dependencies before deployment.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Error

• Location: url2png.sh:3

Finding

Arbitrary URL Rendering Enables Server-Side Request Forgery

Content

View full analysis

Vulnerability Details

File Location: url2png.sh, lines 3-15
Vulnerability Type: Server-Side Request Forgery through unrestricted browser navigation
Risk Level: High

Vulnerable Code

bash

url="${1:-https://simonwillison.net/2026/Feb/10/showboat-and-rodney}"
outdir=${2:-~/Pictures}
mkdir -p ${outdir}
# cd into outdir, let shot-scraper save with proper name
cd ${outdir}

# take long screenshot for iPhone by default
uvx shot-scraper shot "${url}" \
    --browser chromium \
    --width 390 \
    --retina \
    --wait 10000 \
    --timeout 30000

The resulting file is subsequently returned to the requester according to SKILL.md, lines 39-43:

markdown

## Agent Instructions

1. Execute the `url2png.sh` script.
2. Locate the generated PNG file (default in `~/Pictures` if not specified).
3. Send the file to the user. **Crucial:** To avoid compression or dimension limits (especially on Telegram), send the image as a **document/file** (or ZIP it), do not send as a photo.

Technical Analysis

The first command-line argument is passed directly to Chromium without URL-scheme validation, destination filtering, DNS/IP validation, or redirect restrictions. Although shell quoting prevents ordinary command injection through this argument, it does not prevent the browser from requesting attacker-selected network resources.

Consequently, a remote requester may direct the browser to loopback addresses, private network ranges, link-local services, or cloud instance metadata endpoints. The request originates from the system running the skill rather than from the requester. Any rendered response can be captured in a screenshot and returned to the requester.

Redirects and DNS rebinding can also undermine checks performed only on the original hostname. Destination validation must therefore be applied after DNS resolution and again for every redirect.

Attack Path

1. An attacker i ...[truncated 1259 chars]

Remediation

View remediation

Remediation Suggestions

1. Restrict accepted schemes to https and, only if required, http. Reject file, data, javascript, and all other schemes.
2. Resolve the destination hostname before navigation and reject every address in loopback, private, link-local, multicast, reserved, and unspecified address ranges for both IPv4 and IPv6.
3. Explicitly block cloud metadata addresses and hostnames, including link-local metadata services.
4. Revalidate the hostname and resolved IP address after every redirect. Do not rely solely on validation of the initial URL.
5. Mitigate DNS rebinding by connecting through a controlled proxy or by enforcing destination policies at the network layer.
6. Run Chromium in an isolated container or network namespace with no access to the host network or private infrastructure.
7. Apply an outbound allowlist if the intended use permits limiting screenshots to approved public domains.
8. Disable browser access to local files and unnecessary browser capabilities.
9. Record blocked navigation attempts without logging sensitive URL components or credentials.

T08 · Insecure Dependencies

Error

• Location: install.sh:4

Finding

Unpinned Third-Party Package Is Downloaded and Executed

Content

View full analysis

Vulnerability Details

File Location: install.sh, line 4; url2png.sh, lines 10-15
Vulnerability Type: Unpinned executable dependency and mutable supply-chain resolution
Risk Level: High

Vulnerable Code

install.sh, line 4:

bash

uvx shot-scraper install --browser chromium

url2png.sh, lines 10-15:

bash

uvx shot-scraper shot "${url}" \
    --browser chromium \
    --width 390 \
    --retina \
    --wait 10000 \
    --timeout 30000

Technical Analysis

Both installation and normal runtime invoke shot-scraper through uvx without specifying an exact audited version or integrity hash. This causes the effective executable dependency to be resolved from an external package source and permits it to change after the skill itself has been reviewed.

The installation command also asks the resolved package to install Chromium and associated Playwright components. Package and browser artifacts are therefore trusted without project-level version locking or integrity verification.

This is a supply-chain weakness rather than evidence that the current upstream package is malicious. Nevertheless, if the package source, publisher account, dependency graph, or future release is compromised, attacker-controlled Python code can execute with the permissions of the user running this skill. Repeating mutable resolution during ordinary screenshot execution expands the exposure beyond initial installation.

Attack Path

1. An attacker compromises the relevant package publisher, package repository, dependency chain, or a future package release.
2. A malicious version becomes the version selected by the unpinned uvx shot-scraper invocation.
3. A user installs the skill or invokes url2png.sh.
4. uvx obtains and executes the changed package code.
5. The malicious package operates with the agent user's privileges and can access files, environment variables, network resources, and ...[truncated 675 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin shot-scraper to an exact version that has been reviewed, rather than resolving the latest compatible release.
2. Maintain a lockfile containing cryptographic hashes for the package and all transitive dependencies.
3. Install dependencies once from an approved package index and invoke the installed, pinned executable directly at runtime.
4. Prevent url2png.sh from performing mutable package resolution during every screenshot operation.
5. Pin the Chromium or Playwright browser revision and verify downloaded browser artifacts against trusted checksums or signatures.
6. Use a controlled internal package mirror where practical, with package provenance and integrity verification enabled.
7. Run installation and browser execution as a dedicated unprivileged account inside a restricted container or sandbox.
8. Add automated dependency review and update testing so version changes occur through explicit, auditable changes.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (4)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The trigger phrases "Save this url as image ..." and "Take long screenshot for this url" are broad natural-language patterns that can match ordinary conversation, causing the skill to activate unexpectedly. Because this skill fetches attacker-controlled URLs and runs browser automation, accidental invocation increases exposure to untrusted content and can lead to unintended network access or data handling.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 96% confidence

Finding

The script executes uvx shot-scraper install --browser chromium without pinning shot-scraper to a specific version, so installation behavior depends on whatever package version is current at runtime. This creates a supply-chain risk: a malicious or compromised upstream release could execute unexpected code during install, and this skill explicitly performs a network-fetched tool installation as part of setup.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 91% confidence

Finding

The script invokes uvx shot-scraper without pinning an exact package version, so each run may resolve and execute whatever release is current at that time. This creates a supply-chain risk: a compromised upstream release or unexpected breaking change could cause unreviewed code to run in the user's environment.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The skill fetches an arbitrary user-supplied URL in a real browser and saves output to disk without warning or confirmation. This can be abused to trigger requests to internal or sensitive network locations, interact with hostile pages, or unexpectedly create files, which is more concerning because the skill is explicitly designed to process attacker-controlled URLs.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.