Security audit

Link Brain

Security checks for vulnerabilities and agentic risk

Overview

This is mostly a disclosed local bookmark tool, but it needs review because auto-save can read local or internal resources and imported bookmark data can become executable script in generated HTML views.

Install only if you are comfortable with the skill reading and storing browser bookmarks in ~/.link-brain. Avoid auto-saving file://, localhost, private-network, or attacker-supplied URLs, and avoid opening generated GUI/graph HTML after importing untrusted bookmark exports until URL validation and HTML escaping are fixed.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/brain.py:626
Finding: Unrestricted URL Fetch Enables Local File Disclosure and Server-Side Request Forgery
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/brain.py:909
Finding: Stored Script Injection in Generated Graph and GUI HTML Files
Content: View full analysis
Link Brain - Knowledge Graph * {{ margin: 0; padding: 0; box-sizing: border-box; }} body {{ background: #0a0a0a; color: #e0e0e0; font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', sans-serif; overflow: hidden; }} canvas {{ display: block; cursor: grab; }} canvas:active {{ cursor: grabbing; }} #tooltip {{ position: fixed; display: none; background: #1a1a2e; border: 1px solid #333; border-radius: 8px; padding: 12px 16px; max-width: 320px; pointer-events: none; box-shadow: 0 4px 20px rgba(0,0,0,0.5); z-index: 100; font-size: 13px; }} #tooltip .tt-title {{ font-weight: 600; font-size: 14px; margin-bottom: 4px; color: #fff; }} #tooltip .tt-summary {{ color: #aaa; font-size: 12px; line-height: 1.4; }} #tooltip .tt-tags {{ margin-top: 6px; }} #tooltip .tt-tag {{ display: inline-block; padding: 2px 6px; border-radius: 4px; font-size: 11px; margin: 2px; }}

🧠 Link Brain

{len(nodes)} links, {len(edges)} connections
Remediation: View remediation
... ``` Then parse only its text: ```javascript const DATA = JSON.parse( document.getElementById('link-brain-data').textContent ); ``` 3. Before embedding JSON in HTML, make it safe for the HTML parser by escaping at least: - `<` as `\u003c` - `>` as `\u003e` - `&` as `\u0026` - U+2028 as `\u2028` - U+2029 as `\u2029` Escaping `<` prevents an attacker-controlled `` sequence from being recognized by the HTML parser. 4. Prefer a well-reviewed serialization helper specifically intended for embedding JSON in HTML. 5. Replace graph tag rendering through `innerHTML` with explicit DOM construction: ```javascript const dot = document.createElement('span'); dot.className = 'tag-dot'; dot.style.background = tagColors[tag] || '#666'; el.appendChild(dot); el.appendChild(document.createTextNode(`${tag} (${count})`)); ``` 6. Use `textContent` for all titles, summaries, tags, collection names, and other untrusted text. 7. Validate link protocols before assigning URLs to anchors. Permit only expected schemes such as `https:` and, if necessary, `http:`. Reject `javascript:`, `data:`, and other active schemes. 8. Add a restrictive Content Security Policy to generated files. For example, avoid inline scripts and permit no remote script sources. A CSP should be defense in depth and not a substitute for contextual escaping. 9. Add regression tests using imported and manually saved values containing: ```html ``` as well as tags containing markup and event-handler attributes. 10. Verify both `console.html` and `graph.html` by parsing them in a browser test and confirming that untrusted values remain text and cannot create addit ...[truncated 34 chars]

SkillSpector

Vulnerability Patterns

Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (74)

Tainted flow: 'req' from os.environ.get (line 636, credential/environment) → urllib.request.urlopen (network output)

Critical

Category: Data Flow
Confidence: 97% confidence
Finding: Auto-save fetches arbitrary user-supplied URLs with urllib without any allowlist or private-address restrictions. That enables SSRF-style access to internal services or localhost from the host running the tool, which is especially relevant if the agent can be induced to process attacker-chosen URLs.
Content: Scanner excerpt · scripts/brain.py (reported line 640)May include surrounding context.
python
'User-Agent': 'Mozilla/5.0 (compatible; LinkBrain/4.0)', 'Accept': 'text/html,application/xhtml+xml,text/plain', }) with urllib.request.urlopen(req, timeout=15) as resp: content_type = resp.headers.get('Content-Type', '') charset = 'utf-8' if 'charset=' in content_type:

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: The declared description frames the skill as a local knowledge base, but the documented behavior expands into remote fetching, browser data scanning, third-party import parsing, sync tracking, analytics, and opening generated content in a browser. That mismatch is dangerous because users may consent to a seemingly local bookmarking tool without realizing it can access private browser data, process imported history datasets, and perform network activity.
Content: No source excerpt is available for this finding.

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 14)May include surrounding context.
md
python3 scripts/brain.py quickstart # auto-imports browser bookmarks + opens GUI

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 15)May include surrounding context.
md
python3 scripts/brain.py quickstart # auto-imports browser bookmarks + opens GUI

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 16)May include surrounding context.
md
python3 scripts/brain.py quickstart # auto-imports browser bookmarks + opens GUI

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 51)May include surrounding context.
md
python3 scripts/brain.py quickstart # auto-imports browser bookmarks + opens GUI

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 62)May include surrounding context.
md
python3 scripts/brain.py quickstart # auto-imports browser bookmarks + opens GUI

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 68)May include surrounding context.
md
python3 scripts/brain.py quickstart # auto-imports browser bookmarks + opens GUI

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 80)May include surrounding context.
md
python3 scripts/brain.py quickstart # auto-imports browser bookmarks + opens GUI

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 81)May include surrounding context.
md
python3 scripts/brain.py quickstart # auto-imports browser bookmarks + opens GUI

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 82)May include surrounding context.
md
python3 scripts/brain.py quickstart # auto-imports browser bookmarks + opens GUI

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 83)May include surrounding context.
md
python3 scripts/brain.py quickstart # auto-imports browser bookmarks + opens GUI

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 89)May include surrounding context.
md
python3 scripts/brain.py quickstart # auto-imports browser bookmarks + opens GUI

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 90)May include surrounding context.
md
python3 scripts/brain.py quickstart # auto-imports browser bookmarks + opens GUI

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 98)May include surrounding context.
md
python3 scripts/brain.py quickstart # auto-imports browser bookmarks + opens GUI

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 106)May include surrounding context.
md
python3 scripts/brain.py quickstart # auto-imports browser bookmarks + opens GUI

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 119)May include surrounding context.
md
python3 scripts/brain.py quickstart # auto-imports browser bookmarks + opens GUI

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 120)May include surrounding context.
md
python3 scripts/brain.py quickstart # auto-imports browser bookmarks + opens GUI

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 121)May include surrounding context.
md
python3 scripts/brain.py quickstart # auto-imports browser bookmarks + opens GUI

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 122)May include surrounding context.
md
python3 scripts/brain.py quickstart # auto-imports browser bookmarks + opens GUI

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 128)May include surrounding context.
md
python3 scripts/brain.py quickstart # auto-imports browser bookmarks + opens GUI

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 129)May include surrounding context.
md
python3 scripts/brain.py quickstart # auto-imports browser bookmarks + opens GUI

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 130)May include surrounding context.
md
python3 scripts/brain.py quickstart # auto-imports browser bookmarks + opens GUI

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 131)May include surrounding context.
md
python3 scripts/brain.py quickstart # auto-imports browser bookmarks + opens GUI

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 132)May include surrounding context.
md
python3 scripts/brain.py quickstart # auto-imports browser bookmarks + opens GUI

Static analysis

No suspicious patterns detected.

Overview

A.I.G

T09 · Insecure Skill Coding Practices

T09 · Insecure Skill Coding Practices

🧠 Link Brain

SkillSpector

Tainted flow: 'req' from os.environ.get (line 636, credential/environment) → urllib.request.urlopen (network output)

Tp4

Ae1

Ae1

Ae1

Ae1

Ae1

Ae1

Ae1

Ae1

Ae1

Ae1

Ae1

Ae1

Ae1

Ae1

Ae1

Ae1

Ae1

Ae1

Ae1

Ae1

Ae1

Ae1

Ae1

Static analysis