T09 · Insecure Skill Coding Practices
Error
- Location
fetcher.js:85- Finding
Chromium Sandbox Disabled While Rendering Untrusted Remote Content
- Content
View full analysis
- Remediation
View remediation
Security audit
hfnews
Security checks for vulnerabilities and agentic risk
Overview
The skill is a disclosed news fetcher, but it opens remote websites with Chromium sandboxing disabled and includes risky Puppeteer dependencies, so it should be reviewed before installation.
Install only if you are comfortable with a news-fetching skill making outbound requests to the listed news sites. Prefer the RSS-based script or require the browser fetcher to run with Chromium sandboxing enabled, updated dependencies, and restricted network egress before trusting it in an environment with sensitive files or secrets.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (14)
Known Vulnerable Dependency: basic-ftp==5.1.0 — 4 advisory(ies): CVE-2026-27699 (Basic FTP has Path Traversal Vulnerability in its downloadToDir() method); GHSA-6v7q-wjvx-w8wg (basic-ftp: Incomplete CRLF Injection Protection Allows Arbitrary FTP Command Exe); CVE-2026-41324 (basic-ftp vulnerable to denial of service via unbounded memory consumption in Cl) +1 more
Critical
- Category
- Supply Chain
- Confidence
- 90% confidence
- Finding
The lockfile pins basic-ftp 5.1.0, which is flagged for multiple upstream issues including path traversal, CRLF/command injection, and denial of service. In this skill, basic-ftp is only a transitive dependency via get-uri/pac-proxy-agent/proxy-agent/puppeteer rather than a directly used library, so exploitability depends on whether the skill allows attacker-controlled FTP or PAC/proxy inputs; that makes it real but somewhat context-limited.
- Content
Known Vulnerable Dependency: extract-zip==2.0.1 — 2 advisory(ies): CVE-2026-19693 (extract-zip allows arbitrary file writes through symlink archive entries); CVE-2026-56876 (extract-zip unvalidated symlink path traversal)
High
- Category
- Supply Chain
- Confidence
- 94% confidence
- Finding
extract-zip 2.0.1 is present and has advisories for arbitrary file write and symlink path traversal during archive extraction. Because puppeteer commonly downloads and extracts browser binaries through @puppeteer/browsers, this dependency is relevant in this skill’s installation/runtime supply chain and could permit overwrite of files if a malicious archive is processed.
- Content
Known Vulnerable Dependency: ip-address==10.1.0 — 2 advisory(ies): CVE-2026-69192 (ip-address: Address4 decodes leading-zero octets as decimal while resolvers deco); CVE-2026-42338 (ip-address has XSS in Address6 HTML-emitting methods)
High
- Category
- Supply Chain
- Confidence
- 80% confidence
- Finding
ip-address 10.1.0 is included transitively through socks-related proxy handling and has advisories involving octet parsing ambiguity and XSS in HTML-emitting helpers. In this skill context, the package is unlikely to render HTML and may only be used for proxy/address parsing, so the issue is real upstream but probably has limited direct exploitability here unless untrusted proxy/address data is accepted and displayed.
- Content
Known Vulnerable Dependency: js-yaml==4.1.1 — 4 advisory(ies): CVE-2026-84375 (js-yaml: maxTotalMergeKeys does not limit CPU use for empty merge sources); CVE-2026-59869 (js-yaml: YAML merge-key chains can force quadratic CPU consumption); GHSA-5p4m-2wfm-xmqj (JS-YAML: Quadratic CPU consumption in !!omap resolution (3.x and 4.x) — CVE-2026) +1 more
High
- Category
- Supply Chain
- Confidence
- 80% confidence
- Finding
js-yaml 4.1.1 is present and has CPU consumption / denial-of-service advisories related to complex YAML parsing. Here it appears transitively through cosmiconfig used by puppeteer, so risk depends on whether the skill loads attacker-controlled YAML configuration; without that, practical exposure is limited but the vulnerable package is genuinely present.
- Content
Known Vulnerable Dependency: ws==8.19.0 — 2 advisory(ies): CVE-2026-45736 (ws: Uninitialized memory disclosure); CVE-2026-48779 (ws: Memory exhaustion DoS from tiny fragments and data chunks)
High
- Category
- Supply Chain
- Confidence
- 87% confidence
- Finding
ws 8.19.0 is included by puppeteer-core and has advisories for memory disclosure and memory-exhaustion denial of service. Since puppeteer uses WebSocket connections to communicate with browsers/devtools, this package is operationally relevant; if an attacker can influence or access those channels, they may trigger crashes or potentially expose memory contents.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 93% confidence
- Finding
The skill clearly relies on network access to fetch news, but the manifest does not declare any explicit tool scope or allowed tools. Missing scope declarations weaken least-privilege controls and can allow the runtime to grant broader capabilities than reviewers or users expect, increasing the chance of unintended external access.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
Natural-language strings, keyword extraction, blacklist terms, navigation filters, and output messaging are all tailored to German, with no indication that the user can opt into or change locale. The policy requires flagging language or locale constraints when a skill forces a specific language without user choice or clear justification.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The manifest describes a news fetcher focused on IT and Cybersecurity with political and sports noise filtered out. However, the SOURCES configuration includes a large 'Allgemeines' general-news category, and later keyword extraction explicitly models political topics such as AfD, BSW, Ampel, migration, Israel, China, and Europa, indicating broader general/political aggregation than the stated focused scope.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The manifest frames this skill as customized for IT and cybersecurity interests while filtering political and sports noise. However, the source list explicitly includes a 'general' category with broad mainstream news outlets, so the implemented behavior is wider than the described specialized scope.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
The usage examples and output format require German terms such as "Allgemeines" and "Titel" while the skill description does not state that the tool is intentionally German-only or provide an alternative language option. This can violate language/locale policy when users are not given an explicit opt-in or justified locale restriction.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
This code launches a browser and makes HTTP requests to multiple third-party news sites, but there is no comment, docstring, or explicit user-facing notice describing that outbound network access will occur. For code files, network calls that transmit user or system data should have some form of disclosure unless clearly covered by the skill description, which is not present here.
- Content
Intent-Code Divergence
Low
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The code lowercases the user argument and validates it against SOURCES keys, but the actual keys are 'Allgemeines', 'IT', and 'Cybersecurity'. The usage text claims valid arguments are 'general|it|cybersecurity', while
SOURCES[category]will reject 'general' and also reject lowercase 'it'/'cybersecurity' because the object keys are mixed-case German/English labels.- Content
Unpinned Dependencies
Low
- Category
- Supply Chain
- Confidence
- 94% confidence
- Finding
The dependency uses a caret range (^23.0.0), which allows automatic installation of newer minor and patch releases. This can introduce supply-chain risk because upstream changes, regressions, or a compromised package release could be pulled in without explicit review; the use of Puppeteer also increases sensitivity because it is a large, complex dependency that downloads browser components and processes untrusted web content.
- Content
json "description": "News fetcher with headless browser", "main": "fetcher.js", "dependencies": { "puppeteer": "^23.0.0" } }
Intent-Code Divergence
Low
- Category
- Not specified by scanner
- Confidence
- 82% confidence
- Finding
The top-level docstring states 'News fetcher using RSS feeds', which implies RSS/XML-only behavior. In practice, the code falls back to JSON parsing for at least one source, so the documentation is not accurate about what formats the script handles.
- Content
Static analysis
No suspicious patterns detected.