Web Quality Audit

• Outcome: Review
• Latest audit: Sep 11, 2026 · 9:37 AM UTC
• Version: 2.0.0

Overview

The skill is a legitimate web-audit helper, but its PinchTab installation and browser-control instructions create review-worthy supply-chain and network-control risks.

Install only after reviewing the PinchTab source and using pinned, verified releases. Avoid curl-to-bash, bind any browser-control service to 127.0.0.1, use an isolated browser profile with no saved credentials, and require explicit approval before screenshots, text extraction, clicks, form fills, or JavaScript evaluation on authenticated or production sites.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (3)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:181

Finding

Unverified Remote Installer Piped Directly into Bash

Content

View full analysis

Remediation

View remediation

' 'pinchtab-installer.sh' | sha256sum --check - less pinchtab-installer.sh bash pinchtab-installer.sh ``` 5. Replace the placeholder URL and checksum only with official, audited, immutable release information. 6. State that PinchTab is optional and unnecessary for the local static-analysis script. 7. Recommend installation and execution as an unprivileged user in an isolated environment. ]]>

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:187

Finding

Unpinned npm Package and Docker Image Installation

Content

View full analysis

Remediation

View remediation

``` 2. Document the expected npm package integrity metadata and verify the package's provenance before installation. 3. Prefer a project-local dependency over a global installation where supported, and disable lifecycle scripts unless they are explicitly required and reviewed: ```bash npm install --save-exact --ignore-scripts pinchtab@ ``` 4. Pin the Docker image by immutable digest rather than relying on a mutable default tag: ```bash docker run -d \ -p 127.0.0.1:9867:9867 \ pinchtab/pinchtab@sha256: ``` 5. Record the reviewed version and digest in the Skill documentation and establish a controlled process for updates. 6. Run the container with additional restrictions where compatible, such as a non-root user, dropped Linux capabilities, a read-only root filesystem, and explicit resource limits. ]]>

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: SKILL.md:190

Finding

Browser-Control Service Published on All Host Network Interfaces

Content

View full analysis

Remediation

View remediation

``` 2. Require strong authentication for every browser-control endpoint if the service supports it. 3. Do not expose the API directly to untrusted networks. If remote access is required, place it behind an authenticated TLS reverse proxy or a restricted VPN. 4. Apply host firewall rules that permit only explicitly authorized clients. 5. Use an isolated browser profile containing no personal cookies, saved credentials, or authenticated sessions. 6. Restrict the container's outbound network access to the hosts needed for the audit to reduce access to internal services and metadata endpoints. 7. Run the service with a non-root user, drop unnecessary capabilities, and avoid privileged mode and host filesystem mounts. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Memory Poisoning: Persistent Context Injection, Context Window Stuffing, Memory Manipulation
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (12)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

The declared description promises a broad, comprehensive web audit platform with browser automation and advanced capabilities. The supplied code only performs a narrow static analysis of local HTML files using grep/find in a shell script. Its primary purpose is materially narrower than declared, and key advertised capabilities—browser control, automated testing, orchestration, performance analysis, and comprehensive audit categories—are absent. While the code does perform limited web-quality checks, the description substantially overstates what this code chunk actually does.

Content

No source excerpt is available for this finding.

External Script Fetching

High

• Category: Supply Chain
• Confidence: 98% confidence

Finding

curl -fsSL https://pinchtab.com/install.sh | bash executes remote code directly from the network without inspection, signature verification, or pinning. If the host, CDN, DNS, TLS termination, or script contents are compromised, users can suffer immediate arbitrary code execution on their machine.

Content

Scanner excerpt · SKILL.md (reported line 185)May include surrounding context.

bash

# macOS / Linux
curl -fsSL https://pinchtab.com/install.sh | bash

# npm
npm install -g pinchtab

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 97% confidence

Finding

Piping fetched content directly to bash creates a high-risk command chain that removes opportunities for review and amplifies any compromise of the remote source into instant shell execution. In skill documentation, this is especially dangerous because users or agents may copy and run it verbatim.

Content

Scanner excerpt · SKILL.md (reported line 185)May include surrounding context.

bash

# macOS / Linux
curl -fsSL https://pinchtab.com/install.sh | bash

# npm
npm install -g pinchtab

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

The skill encourages browser automation, screenshots, text extraction, and interaction with live sites without warning about sensitive data exposure, authenticated sessions, or unintended actions on production systems. Because AI agents may follow these examples mechanically, the lack of safety constraints can lead to capture or transmission of private page content and unsafe live-site interaction.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 89% confidence

Finding

The Docker example pulls pinchtab/pinchtab without a fixed tag or digest, which makes the installed runtime non-reproducible and exposes users to upstream image changes or a compromised latest image. In a skill that encourages direct execution of setup commands, this increases supply-chain risk.

Content

No source excerpt is available for this finding.

Context Window Stuffing

Medium

• Category: Memory Poisoning
• Confidence: 85% confidence

Finding

Skill attempts to fill the context window with filler content, displacing legitimate instructions and safety constraints. This can degrade agent performance or bypass safety boundaries.

Content

Scanner excerpt · SKILL.md (reported line 236)May include surrounding context.

md

# Click element by ref
pinchtab click e5

# Fill input
pinchtab fill e12 "[e-mail]"

# Press key

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 247)May include surrounding context.

bash

# Create instance
TAB=$(curl -s -X POST http://localhost:9867/instances \
  -d '{"profile":"work"}' | jq -r '.id')

# Navigate

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 402)May include surrounding context.

bash

# Create instance
TAB=$(curl -s -X POST http://localhost:9867/instances \
  -d '{"profile":"work"}' | jq -r '.id')

# Navigate

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 251)May include surrounding context.

md

-d '{"profile":"work"}' | jq -r '.id')

# Navigate
curl -X POST "http://localhost:9867/instances/$TAB/tabs/open" \
  -d '{"url":"https://example.com"}'

# Get snapshot (wait 3s first)

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 280)May include surrounding context.

md

# Navigate and measure load time
START=$(date +%s%N)
curl -s -X POST "http://localhost:9867/instances/$INST/tabs/open" \
  -d "{\"url\":\"$URL\"}" > /dev/null
sleep 3
END=$(date +%s%N)

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 377)May include surrounding context.

bash

# Navigate + wait + filter (14x more token-efficient)
curl -X POST http://localhost:9867/navigate \
  -d '{"url": "https://example.com"}' && \
sleep 3 && \
curl http://localhost:9867/snapshot | \

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 410)May include surrounding context.

md

# Run tests in parallel
for i in {0..2}; do
  (
    curl -s -X POST "http://localhost:9867/instances/${INSTANCES[$i]}/tabs/open" \
      -d "{\"url\":\"${URLS[$i]}\"}"
    sleep 3
    TITLE=$(curl -s "http://localhost:9867/instances/${INSTANCES[$i]}/text" | jq -r '.title')

Static analysis

No suspicious patterns detected.