Web Quality Audit

• Outcome: Review
• Latest audit: Sep 11, 2026 · 9:37 AM UTC
• Version: 2.0.0

Overview

The skill is a legitimate web-audit helper, but its PinchTab installation and browser-control instructions create review-worthy supply-chain and network-control risks.

Install only after reviewing the PinchTab source and using pinned, verified releases. Avoid curl-to-bash, bind any browser-control service to 127.0.0.1, use an isolated browser profile with no saved credentials, and require explicit approval before screenshots, text extraction, clicks, form fills, or JavaScript evaluation on authenticated or production sites.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (3)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:181
• Finding: Unverified Remote Installer Piped Directly into Bash<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:181-188` **Vulnerability Type**: Remote payload retrieval and immediate execution **Risk Level**: Critical ### Vulnerable Code ```bash ### Installation ```bash # macOS / Linux curl -fsSL https://pinchtab.com/install.sh | bash # npm npm install -g pinchtab ``` ### Technical Analysis The installation instructions pipe a remotely retrieved script directly into Bash. The effective executable payload is not included in the audited project and may change at any time after this review. No immutable version, cryptographic checksum, or signature verification is required before execution. Although PinchTab browser automation is relevant to the Skill's optional browser-validation functionality, immediate execution of mutable network content is not the minimum privilege or safest installation mechanism required to provide that functionality. Static analysis through `scripts/analyze.sh` does not require PinchTab at all. The command executes the downloaded script with all privileges available to the invoking user. Compromise of the remote host, its deployment pipeline, DNS resolution, or another part of the delivery chain could therefore convert the documented installation step into arbitrary local code execution. ### Attack Path 1. An attacker compromises the remote installer, its hosting infrastructure, or its software delivery pipeline. 2. The attacker modifies `https://pinchtab.com/install.sh` to include malicious shell commands. 3. A user follows the Skill's documented installation command. 4. `curl` retrieves the current attacker-controlled response. 5. Bash executes the response immediately, without presenting a stable artifact for review or verifying its integrity. 6. The payload gains the permissions of the invoking user and can access resources available to that account. ### Impact Assessment Successful exploitation provides arbitrary command execution under the invoking user's account. This ...[truncated 506 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove the `curl | bash` installation method. 2. Direct users to a specific, immutable release artifact from the official project repository. 3. Pin the exact release version and publish an expected SHA-256 checksum or a verifiable signature. 4. Separate download, verification, inspection, and execution into explicit steps. For example: ```bash curl -fL -o pinchtab-installer.sh \ https://example.invalid/releases/vX.Y.Z/install.sh printf '%s %s\n' '<EXPECTED_SHA256>' 'pinchtab-installer.sh' | sha256sum --check - less pinchtab-installer.sh bash pinchtab-installer.sh ``` 5. Replace the placeholder URL and checksum only with official, audited, immutable release information. 6. State that PinchTab is optional and unnecessary for the local static-analysis script. 7. Recommend installation and execution as an unprivileged user in an isolated environment. ]]>

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:187
• Finding: Unpinned npm Package and Docker Image Installation<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:187-191` **Vulnerability Type**: Mutable and unpinned third-party dependencies **Risk Level**: Medium ### Vulnerable Code ```bash # npm npm install -g pinchtab # Docker docker run -d -p 9867:9867 pinchtab/pinchtab ``` ### Technical Analysis Both documented alternatives resolve mutable dependency references: - `npm install -g pinchtab` installs whichever version the registry currently resolves for the package's default distribution tag. A global npm installation may execute package lifecycle scripts with the invoking user's permissions. - `pinchtab/pinchtab` does not specify a version tag or immutable image digest. Docker therefore resolves a mutable image reference, normally using its default tag. The installed artifacts can change independently of the reviewed Skill. This weakens reproducibility and creates a supply-chain risk if a registry account, package release, image tag, or upstream build pipeline is compromised. Browser automation is optional to the declared audit functionality, and installing mutable global software exceeds what is necessary for the included static HTML analyzer. ### Attack Path 1. An attacker compromises the npm package, container registry account, image build pipeline, or a mutable published release. 2. The attacker publishes a malicious package version or replaces the image referenced by the mutable tag. 3. A user follows one of the documented commands. 4. The package manager or Docker daemon retrieves the changed artifact without verifying it against a project-specified version and integrity value. 5. For npm, malicious lifecycle code may execute during global installation with the user's permissions. 6. For Docker, the malicious image starts as a service and can perform actions available within its container and configured network environment. ### Impact Assessment A compromised npm package can execute arbitrary commands with the invoking user's privileges d ...[truncated 491 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Pin npm to a specifically reviewed version: ```bash npm install -g pinchtab@<AUDITED_VERSION> ``` 2. Document the expected npm package integrity metadata and verify the package's provenance before installation. 3. Prefer a project-local dependency over a global installation where supported, and disable lifecycle scripts unless they are explicitly required and reviewed: ```bash npm install --save-exact --ignore-scripts pinchtab@<AUDITED_VERSION> ``` 4. Pin the Docker image by immutable digest rather than relying on a mutable default tag: ```bash docker run -d \ -p 127.0.0.1:9867:9867 \ pinchtab/pinchtab@sha256:<VERIFIED_DIGEST> ``` 5. Record the reviewed version and digest in the Skill documentation and establish a controlled process for updates. 6. Run the container with additional restrictions where compatible, such as a non-root user, dropped Linux capabilities, a read-only root filesystem, and explicit resource limits. ]]>

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: SKILL.md:190
• Finding: Browser-Control Service Published on All Host Network Interfaces<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:190-191` **Vulnerability Type**: Excessive network exposure of a browser automation API **Risk Level**: High ### Vulnerable Code ```bash # Docker docker run -d -p 9867:9867 pinchtab/pinchtab ``` ### Technical Analysis Docker's abbreviated publishing syntax, `-p 9867:9867`, ordinarily publishes the container port on all host interfaces rather than restricting it to loopback. The same documentation describes API capabilities that include opening URLs, extracting page content, taking snapshots, clicking elements, filling fields, and evaluating JavaScript. Publishing such a control plane beyond the local host is unnecessary for local web-quality auditing and violates least-privilege network exposure. The project documentation does not show authentication or network access controls for this deployment command. Whether the port is externally reachable also depends on host firewall and network configuration, but the command itself does not enforce local-only access. ### Attack Path 1. A user launches PinchTab using the documented Docker command. 2. Docker publishes TCP port 9867 on the host's available network interfaces. 3. The host is connected to a network from which that port is reachable, and no firewall or effective service authentication blocks the request. 4. An attacker discovers or is otherwise able to access port 9867. 5. The attacker submits requests to the documented browser-control endpoints. 6. The attacker may direct browser navigation, retrieve rendered content, or trigger supported browser actions within the service's effective session and network context. ### Impact Assessment If the service is reachable without effective authentication, an attacker may obtain remote control over the managed browser functionality. Potential scope includes reading content rendered in controlled tabs, navigating to attacker-selected or internal URLs, invoking supported page actions, and interactin ...[truncated 487 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Bind the published port explicitly to loopback: ```bash docker run -d \ -p 127.0.0.1:9867:9867 \ pinchtab/pinchtab@sha256:<VERIFIED_DIGEST> ``` 2. Require strong authentication for every browser-control endpoint if the service supports it. 3. Do not expose the API directly to untrusted networks. If remote access is required, place it behind an authenticated TLS reverse proxy or a restricted VPN. 4. Apply host firewall rules that permit only explicitly authorized clients. 5. Use an isolated browser profile containing no personal cookies, saved credentials, or authenticated sessions. 6. Restrict the container's outbound network access to the hosts needed for the audit to reduce access to internal services and metadata endpoints. 7. Run the service with a non-root user, drop unnecessary capabilities, and avoid privileged mode and host filesystem mounts. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Memory Poisoning: Persistent Context Injection, Context Window Stuffing, Memory Manipulation
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (12)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: The declared description promises a broad, comprehensive web audit platform with browser automation and advanced capabilities. The supplied code only performs a narrow static analysis of local HTML files using grep/find in a shell script. Its primary purpose is materially narrower than declared, and key advertised capabilities—browser control, automated testing, orchestration, performance analysis, and comprehensive audit categories—are absent. While the code does perform limited web-quality checks, the description substantially overstates what this code chunk actually does.

External Script Fetching

High

• Category: Supply Chain

Content

```bash
# macOS / Linux
curl -fsSL https://pinchtab.com/install.sh | bash

# npm
npm install -g pinchtab

• Confidence: 98% confidence
• Finding: `curl -fsSL https://pinchtab.com/install.sh | bash` executes remote code directly from the network without inspection, signature verification, or pinning. If the host, CDN, DNS, TLS termination, or script contents are compromised, users can suffer immediate arbitrary code execution on their machine.

Chaining Abuse

High

• Category: Tool Misuse

Content

```bash
# macOS / Linux
curl -fsSL https://pinchtab.com/install.sh | bash

# npm
npm install -g pinchtab

• Confidence: 97% confidence
• Finding: Piping fetched content directly to `bash` creates a high-risk command chain that removes opportunities for review and amplifies any compromise of the remote source into instant shell execution. In skill documentation, this is especially dangerous because users or agents may copy and run it verbatim.

Missing User Warnings

Medium

• Confidence: 86% confidence
• Finding: The skill encourages browser automation, screenshots, text extraction, and interaction with live sites without warning about sensitive data exposure, authenticated sessions, or unintended actions on production systems. Because AI agents may follow these examples mechanically, the lack of safety constraints can lead to capture or transmission of private page content and unsafe live-site interaction.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 89% confidence
• Finding: The Docker example pulls `pinchtab/pinchtab` without a fixed tag or digest, which makes the installed runtime non-reproducible and exposes users to upstream image changes or a compromised latest image. In a skill that encourages direct execution of setup commands, this increases supply-chain risk.

Context Window Stuffing

Medium

• Category: Memory Poisoning

Content

# Click element by ref
pinchtab click e5

# Fill input
pinchtab fill e12 "[e-mail]"

# Press key

• Confidence: 85% confidence
• Finding: Skill attempts to fill the context window with filler content, displacing legitimate instructions and safety constraints. This can degrade agent performance or bypass safety boundaries.

External Transmission

Medium

• Category: Data Exfiltration

Content

```bash
# Create instance
TAB=$(curl -s -X POST http://localhost:9867/instances \
  -d '{"profile":"work"}' | jq -r '.id')

# Navigate

• Confidence: 60% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

```bash
# Create instance
TAB=$(curl -s -X POST http://localhost:9867/instances \
  -d '{"profile":"work"}' | jq -r '.id')

# Navigate

• Confidence: 60% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

-d '{"profile":"work"}' | jq -r '.id')

# Navigate
curl -X POST "http://localhost:9867/instances/$TAB/tabs/open" \
  -d '{"url":"https://example.com"}'

# Get snapshot (wait 3s first)

• Confidence: 60% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

# Navigate and measure load time
START=$(date +%s%N)
curl -s -X POST "http://localhost:9867/instances/$INST/tabs/open" \
  -d "{\"url\":\"$URL\"}" > /dev/null
sleep 3
END=$(date +%s%N)

• Confidence: 60% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

```bash
# Navigate + wait + filter (14x more token-efficient)
curl -X POST http://localhost:9867/navigate \
  -d '{"url": "https://example.com"}' && \
sleep 3 && \
curl http://localhost:9867/snapshot | \

• Confidence: 60% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

# Run tests in parallel
for i in {0..2}; do
  (
    curl -s -X POST "http://localhost:9867/instances/${INSTANCES[$i]}/tabs/open" \
      -d "{\"url\":\"${URLS[$i]}\"}"
    sleep 3
    TITLE=$(curl -s "http://localhost:9867/instances/${INSTANCES[$i]}/text" | jq -r '.title')

• Confidence: 60% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Static analysis

No suspicious patterns detected.