Listing Swarm

• Outcome: Review
• Latest audit: Sep 10, 2026 · 4:05 PM UTC
• Version: 1.0.3

Overview

The skill has a coherent listing-automation purpose, but its optional inbox access and credential handling need review before installation.

Use a dedicated submission email account with an app password, not a personal inbox. Use a low-balance CAPTCHA key, expect product/contact data to be submitted to many third-party sites, and skip or remove any non-HTTPS directory target unless you explicitly accept that risk.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T09 · Insecure Skill Coding Practices

Warning

• Location: captcha.js:90

Finding

CAPTCHA API Key Exposed in URL Query Strings

Content

View full analysis

Vulnerability Details

File Location: captcha.js:90-98, captcha.js:110-117, and captcha.js:139-145
Vulnerability Type: Sensitive credential exposure through request URLs
Risk Level: Medium

Vulnerable Code

js

// Submit captcha
const submitParams = new URLSearchParams({
  key: this.apiKey,
  method,
  json: 1,
  ...params,
});

const submitRes = await fetch(`https://2captcha.com/in.php?${submitParams}`);
const submitData = await submitRes.json();

js

const resultParams = new URLSearchParams({
  key: this.apiKey,
  action: 'get',
  id: captchaId,
  json: 1,
});

const resultRes = await fetch(`https://2captcha.com/res.php?${resultParams}`);
const resultData = await resultRes.json();

js

const params = new URLSearchParams({
  key: this.apiKey,
  action: 'reportbad',
  id: captchaId,
});
await fetch(`https://2captcha.com/res.php?${params}`);

Technical Analysis

The user-supplied CAPTCHA API key is embedded directly into the query string of multiple GET requests. Sending the key to the selected CAPTCHA provider is necessary for the declared functionality, but transmitting it as part of a URL is not a least-exposure design.

TLS protects the URL while it is in transit between the client and the HTTPS server. It does not prevent the complete URL from being retained by the destination's access logs, reverse proxies, debugging systems, network monitoring products, exception reports, or local instrumentation. Query parameters are also commonly recorded more broadly than request bodies or authorization headers.

This issue affects submission, result polling, and bad-result reporting, repeatedly exposing the same credential in generated request URLs.

Attack Path

1. The user places a funded CAPTCHA service key in CAPTCHA_API_KEY or passes it to CaptchaSolver.
2. The Skill embeds that key in the key query parameter.
3. The complete re ...[truncated 848 chars]

Remediation

View remediation

Remediation Suggestions

1. Use the provider's POST API where supported.
2. Place the API key in an authorization header or POST body rather than the URL.
3. Configure HTTP clients, proxies, and diagnostics to redact credentials.
4. Avoid including complete request URLs in exceptions or application logs.
5. Add automated tests that fail if CAPTCHA_API_KEY appears in a generated URL.
6. Document key rotation and revocation procedures for users who suspect exposure.
7. If compatibility requires query authentication, explicitly warn users of the logging exposure and recommend a dedicated, low-balance key.

T09 · Insecure Skill Coding Practices

Warning

• Location: directories.json:580

Finding

Directory Submission Target Uses Unencrypted HTTP

Content

View full analysis

Vulnerability Details

File Location: directories.json:580-581
Vulnerability Type: Plaintext transmission to an untrusted directory endpoint
Risk Level: Medium

Vulnerable Code

json

{
  "name": "Ezwebdirectory",
  "url": "http://ezwebdirectory.com/",
  "submitUrl": "http://ezwebdirectory.com/",
  "domainRating": 0,
  "monthlyVisits": "0",
  "experience": "",
  "pricing": ""
}

Technical Analysis

The directory list instructs the agent to visit and potentially submit product information through a plaintext HTTP endpoint. HTTP provides neither transport confidentiality nor server-authenticated integrity.

The declared submission data can include a product name, description, URLs, and contact email. A network-positioned attacker can observe this information, alter responses, redirect the browser, or replace the submission page with attacker-controlled content. Because an AI agent is expected to inspect and interact with the returned page, modified page content can also attempt to mislead the agent into disclosing additional information or navigating to a malicious destination.

The use of this endpoint is not necessary if no trusted HTTPS endpoint exists: the directory can be skipped or require explicit user approval.

Attack Path

1. The Skill loads directories.json and selects the Ezwebdirectory submission target.
2. The agent navigates to http://ezwebdirectory.com/.
3. An attacker controlling the local network, gateway, DNS path, or another on-path component intercepts the unencrypted request.
4. The attacker reads or modifies the response and can present a counterfeit submission form or redirect.
5. The agent submits product/contact information to the intercepted endpoint or follows attacker-supplied content.

No evidence was found that this endpoint receives runtime credentials automatically. The exposed scope depends on the fields the agent enters into the form.

...[truncated 365 chars]

Remediation

View remediation

Remediation Suggestions

1. Replace the HTTP addresses with a verified HTTPS endpoint if one is available.
2. Otherwise, remove or disable this directory by default.
3. Validate every directory URL before navigation and reject non-HTTPS schemes.
4. Require explicit, per-target user approval before making any plaintext request.
5. Never enter credentials, private data, or sensitive contact information into an HTTP form.
6. Maintain an allowlist of reviewed HTTPS origins and detect redirects to non-HTTPS or unexpected domains.
7. Periodically verify the ownership, TLS status, and submission URLs of all listed directories.

T05 · Unauthorized Access and Privilege Escalation

Note

• Location: email.js:73

Finding

IMAP Inbox Opened with Unnecessary Write Capability

Content

View full analysis

Vulnerability Details

File Location: email.js:73
Vulnerability Type: Excessive mailbox privileges contrary to documented read-only access
Risk Level: Low

Vulnerable Code

js

this.imap.openBox('INBOX', false, (err, box) => {
  if (err) return reject(err);

  const since = new Date();
  since.setMinutes(since.getMinutes() - maxAgeMinutes);

  const searchCriteria = [
    ['SINCE', since],
    ['FROM', fromDomain],
  ];

  this.imap.search(searchCriteria, (err, results) => {
    if (err) return reject(err);
    if (!results || results.length === 0) {
      return resolve(null);
    }

    // Get the most recent matching email
    const latestUid = results[results.length - 1];
    const fetch = this.imap.fetch([latestUid], { bodies: '' });

Technical Analysis

In the node-imap API, the second argument to openBox specifies whether the mailbox is opened read-only. Passing false opens INBOX with read-write capability.

The implemented feature only searches for recent messages and reads their bodies to extract verification links. Write access is unnecessary and conflicts with the documentation's statement that IMAP access is read-only. The reviewed code does not currently delete messages or intentionally alter flags, but the session grants broader capabilities than the task requires.

This excess capability increases the impact of a future coding error or a compromised email-processing dependency. The overall email account permissions remain determined by the supplied IMAP credentials; opening the mailbox read-only would reduce the capabilities available through this session.

Attack Path

1. The user supplies valid IMAP credentials, potentially for an existing mailbox.
2. The Skill authenticates to the configured server over TLS.
3. openBox('INBOX', false, ...) opens the inbox in read-write mode.
4. A future defect, unsafe extension, or compromised dependency op ...[truncated 758 chars]

Remediation

View remediation

Remediation Suggestions

1. Open the mailbox in read-only mode:

   js

   this.imap.openBox('INBOX', true, (err, box) => {
   

2. Retain the recommendation to use a dedicated mailbox and an app-specific password.
3. Use credentials restricted to IMAP read access where the provider supports granular permissions.
4. Avoid setting flags, moving messages, or deleting messages during verification processing.
5. Add a test confirming that the read-only argument remains true.
6. Update security documentation to describe the actual access mode and limitations accurately.
7. Consider searching a dedicated folder or alias rather than exposing a general-purpose inbox.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (11)

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The documentation makes a materially misleading privacy claim by stating the skill does not access the user's email inbox, then later describing optional IMAP-based inbox access for automated verification. Users may provide email credentials under a false understanding of scope, which undermines informed consent and can lead to unnecessary exposure of mailbox contents.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The documentation describes automatic email verification via IMAP without an explicit opt-in gate at the moment of use. Because inbox access is sensitive, enabling automatic processing without clear per-session consent can cause the agent to access emails more broadly than the user expects, especially if credentials are present in the environment.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 94% confidence

Finding

The skill requires sensitive environment variables and clearly performs networked automation, but it does not declare an explicit tool scope such as permissions or allowed-tools. That makes the runtime trust boundary ambiguous and can allow broader-than-necessary access to secrets and outbound network actions, which is especially risky here because the skill handles IMAP credentials, captcha API keys, and automated submissions to many third-party sites.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · captcha.js (reported line 18)May include surrounding context.

js

resultUrl: 'https://2captcha.com/res.php',
  },
  'anti-captcha': {
    submitUrl: 'https://api.anti-captcha.com/createTask',
    resultUrl: 'https://api.anti-captcha.com/getTaskResult',
  },
  'capsolver': {

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · captcha.js (reported line 19)May include surrounding context.

js

resultUrl: 'https://2captcha.com/res.php',
  },
  'anti-captcha': {
    submitUrl: 'https://api.anti-captcha.com/createTask',
    resultUrl: 'https://api.anti-captcha.com/getTaskResult',
  },
  'capsolver': {

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · captcha.js (reported line 22)May include surrounding context.

js

resultUrl: 'https://api.anti-captcha.com/getTaskResult',
  },
  'capsolver': {
    submitUrl: 'https://api.capsolver.com/createTask',
    resultUrl: 'https://api.capsolver.com/getTaskResult',
  },
};

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · captcha.js (reported line 23)May include surrounding context.

js

resultUrl: 'https://api.anti-captcha.com/getTaskResult',
  },
  'capsolver': {
    submitUrl: 'https://api.capsolver.com/createTask',
    resultUrl: 'https://api.capsolver.com/getTaskResult',
  },
};

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The code sends CAPTCHA images, site keys, page URLs, and the user's CAPTCHA API key to third-party solving providers such as 2captcha. That is an intentional part of the feature, but there is no in-code consent gate, disclosure mechanism, domain allowlist, or minimization control before transmitting potentially sensitive browsing metadata and challenge content off-platform. In the context of an automation skill that submits forms across many sites, this increases privacy, compliance, and data-handling risk.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · email.js (reported line 160)May include surrounding context.

js

return {
      found: false,
      message: `No verification email from ${fromDomain} found within ${timeoutMinutes} minutes`,
    };
  }
}

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The statement that 'Nothing else goes anywhere' is inaccurate because the workflow involves external IMAP connections to an email provider and follow-on browsing to verification links derived from email. While this is not necessarily exfiltration beyond intended workflow, the misleading statement obscures external data flows and weakens user understanding of where their data and derived artifacts are sent.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The directory entry for Ezwebdirectory uses plain HTTP for both url and submitUrl, which allows network attackers to tamper with page content, redirects, and any data submitted by the automation. In this skill’s context, the agent is designed to fill forms and potentially handle email verification and other user-supplied data across many third-party sites, so directing automation to a non-TLS endpoint materially increases the risk of interception or malicious content injection.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.env_credential_access

Environment variable access combined with network send.

Critical

• Code: suspicious.env_credential_access
• Location: email.js:21