PagePop

• Outcome: Review
• Latest audit: May 29, 2026 · 9:39 PM UTC
• Version: 0.0.4

Overview

This appears to be a real PagePop integration, but it needs Review because configuration can redirect PagePop credentials and user content to a non-PagePop API endpoint.

Install only if you trust the PagePop service, the publisher, and the host environment that will run it. Do not set PAGEPOP_API_BASE_URL or --api-base-url unless you control and trust that endpoint, and avoid login-token-file unless you understand that it bypasses the browser authorization flow. Expect local PagePop state and generated image files to be written unless disabled or cleared.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (9)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 94% confidence
• Finding: The skill advertises significant effective capabilities (environment access, file read/write, network, and shell) but does not declare permissions or provide corresponding trust boundaries in the manifest/documentation. That creates a transparency and governance gap: hosts may invoke the skill without understanding that it can store credentials locally, make outbound requests, and execute local commands, increasing the chance of over-privileged deployment and unsafe integration.

Description-Behavior Mismatch

Low

• Confidence: 91% confidence
• Finding: The skill automatically downloads remote image URLs from streamed artifact data to local disk, which exceeds a pure conversation relay role and creates a file-write/network-fetch side effect. If the backend or stream data is compromised, this can trigger unreviewed local storage of attacker-controlled content, consume disk space, and introduce downstream risk if other tools later process those files.

Context-Inappropriate Capability

Medium

• Confidence: 93% confidence
• Finding: The code supports reading a local login token file and then using that token directly in request headers, bypassing the normal interactive authorization flow. This expands the trust boundary to local filesystem secrets and can cause unintended credential use or exposure if the file path is misconfigured, inherited from environment variables, or controlled by another component.

Context-Inappropriate Capability

Low

• Confidence: 89% confidence
• Finding: The skill emits raw SSE event payloads and full backend data to stdout as structured records, which can expose conversation contents, artifact metadata, URLs, and possibly sensitive backend fields to logs or upstream consumers. In a host-integrated skill, stdout is often captured centrally, so raw event mirroring increases the chance of data leakage beyond the intended artifact-delivery purpose.

Vague Triggers

Medium

• Confidence: 84% confidence
• Finding: The invocation description is very broad ('use when the user wants PagePop to generate, refine, or retrieve content artifacts'), which can cause the host agent to route a wide range of ordinary content requests into a skill that performs authorization, local state storage, and networked operations. Over-broad triggering increases attack surface by making unintended invocation more likely, especially in contexts where users did not explicitly consent to external service use or local credential persistence.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The skill explicitly states that it stores and reuses a local access key, but provides no warning about secure storage, rotation, permissions, or risk of theft from the local filesystem. In this skill's context, that is more dangerous because the same skill also has file, environment, network, and shell capabilities, so a compromised host, weak file permissions, or overly permissive integrations could expose reusable credentials for the external PagePop account.

Missing User Warnings

Medium

• Confidence: 83% confidence
• Finding: The documentation states that conversation state is persisted locally and elsewhere notes local artifact downloads, but it does not present a clear, user-facing notice or consent mechanism around these storage side effects. In host environments handling sensitive prompts, generated content, or internal URLs, silent local persistence can expose data to other local users, backups, logs, or unintended retention beyond user expectations.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: Credential material from a local login token file is consumed implicitly with little runtime disclosure, meaning users or host operators may not realize that a persistent local secret is being used instead of interactive auth. Silent credential use increases the risk of accidental cross-account actions, misuse of stale tokens, and poor auditability.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: Generated artifact images are downloaded and written locally without a prominent user-facing disclosure, creating an undisclosed side effect on the host filesystem. In agent environments, silent writes can violate operator expectations, surprise users, and create privacy or storage-management issues when externally sourced content is persisted automatically.

VirusTotal

65/65 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.