Visual Qa

• Outcome: Review
• Latest audit: Sep 12, 2026 · 7:51 AM UTC
• Version: 1.0.0

Overview

The skill mostly matches its visual testing purpose, but it can run project-provided server commands through a shell, which gives untrusted configs too much local execution power.

Use this only with trusted repositories or inside an isolated container/CI job. Review any .visual-qa.json server value before running it, avoid exposing unrelated secrets in the environment, pin dependencies for CI, and treat saved screenshots/diffs as sensitive artifacts. Do not run the documented rm -rf baseline update unless you have verified the exact target path.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/capture.py:63

Finding

Arbitrary Command Execution Through Shell-Based Server Configuration

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/diff.py:143

Finding

Visual Regression Gate Can Pass When Expected Screenshots Are Missing

Content

View full analysis

= args.threshold status = "✓" if passed_threshold else "✗" if passed_threshold: passed += 1 else: failed += 1 results.append({ 'filename': filename, 'similarity': similarity, 'passed': passed_threshold, 'status': status }) # Summary print(f"\n{'='*60}") print(f"SUMMARY") print(f"{'='*60}") print(f"Total: {len(commo ...[truncated 2201 chars]

Remediation

View remediation

T08 · Insecure Dependencies

Note

• Location: SKILL.md:196

Finding

Unpinned Runtime Dependencies and Browser Installation Reduce Supply-Chain Integrity

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Rogue Agent: Self-Modification, Session Persistence
• Behavioral AST: exec() Call, eval() Call, Dynamic Import

Findings (14)

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 93% confidence

Finding

The skill includes a raw rm -rf .visual-qa/baselines command, which is inherently dangerous because recursive force deletion bypasses safeguards and is easy to misuse in automated or agent-driven workflows. Even though the intended purpose is routine baseline refresh, path confusion, variable substitution in derived versions, or blind copy/paste can lead to destructive file deletion beyond the expected test assets.

Content

Scanner excerpt · SKILL.md (reported line 165)May include surrounding context.

4. Review diff images in .visual-qa/diffs/

5. If changes are intentional, update baselines:

rm -rf .visual-qa/baselines mv .visual-qa/current .visual-qa/baselines

text

Env Variable Harvesting

High

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Code enumerates, copies, or searches environment variables for secrets. Bulk environment access can collect credentials unrelated to the skill's stated purpose.

Content

Scanner excerpt · scripts/capture.py (reported line 74)May include surrounding context.

python

"""Start a local development server."""
    print(f"🚀 Starting server: {command}")
    
    env = os.environ.copy()
    env['PORT'] = str(port)
    
    process = subprocess.Popen(

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 99% confidence

Finding

This duplicate finding identifies the same root issue: shell-based execution of a configurable command allows arbitrary command injection and host code execution. The surrounding skill context does not reduce risk, because a screenshot tool does not need unrestricted shell execution to perform its primary purpose.

Content

Scanner excerpt · scripts/capture.py (reported line 77)May include surrounding context.

python

env = os.environ.copy()
    env['PORT'] = str(port)
    
    process = subprocess.Popen(
        command,
        shell=True,
        stdout=subprocess.PIPE,

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 99% confidence

Finding

This duplicate finding identifies the same root issue: shell-based execution of a configurable command allows arbitrary command injection and host code execution. The surrounding skill context does not reduce risk, because a screenshot tool does not need unrestricted shell execution to perform its primary purpose.

Content

Scanner excerpt · scripts/capture.py (reported line 77)May include surrounding context.

python

env = os.environ.copy()
    env['PORT'] = str(port)
    
    process = subprocess.Popen(
        command,
        shell=True,
        stdout=subprocess.PIPE,

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The documented workflow instructs users to delete the entire baseline directory before replacing it, but it does so without an explicit warning, confirmation step, or safer alternative. In an agent or CI-assisted context, destructive shell commands can be copied or executed automatically, causing unintended loss of testing artifacts and potentially broader damage if paths are modified or misresolved.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

Although presented as a screenshot utility, the script also starts arbitrary local commands from --server or config using the shell. This expands the tool from passive capture into a general command-execution primitive, which is dangerous in automation or agent environments where users may not expect code execution.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 98% confidence

Finding

The script executes a user/config-supplied server command via subprocess.Popen with shell=True, which allows shell metacharacter injection if the command string is influenced by untrusted input. In an agent skill context, this is especially risky because configuration or arguments may be attacker-controlled, leading to arbitrary code execution on the host running the skill.

Content

Scanner excerpt · scripts/capture.py (reported line 77)May include surrounding context.

python

env = os.environ.copy()
    env['PORT'] = str(port)
    
    process = subprocess.Popen(
        command,
        shell=True,
        stdout=subprocess.PIPE,

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 65% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · scripts/capture.py (reported line 84)May include surrounding context.

python

stderr=subprocess.PIPE,
        cwd=cwd,
        env=env,
        preexec_fn=os.setsid if os.name != 'nt' else None
    )
    
    # Wait for server to start

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/gate.py (reported line 57)May include surrounding context.

python

cmd.extend(['--port', str(port)])
    
    print(f"🔧 Running capture...")
    result = subprocess.run(cmd)
    
    return result.returncode == 0

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/gate.py (reported line 74)May include surrounding context.

python

cmd.extend(['--port', str(port)])
    
    print(f"🔧 Running capture...")
    result = subprocess.run(cmd)
    
    return result.returncode == 0

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

When --keep-current or --keep-diffs is used, the script persistently copies screenshots and visual diffs into predictable local directories without any warning that sensitive page content may be retained on disk. In a visual QA workflow, screenshots can easily contain secrets, internal UI states, PII, or environment-specific data, so silent retention increases the chance of accidental disclosure or later exfiltration.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/gate.py (reported line 183)May include surrounding context.

python

if args.keep_current:
            keep_current_dir = '.visual-qa/current'
            os.makedirs(keep_current_dir, exist_ok=True)
            subprocess.run(['cp', '-r', f'{current_dir}/.', keep_current_dir])
            print(f"\n📁 Current screenshots saved to: {keep_current_dir}")
        
        if args.keep_diffs or not passed:

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/gate.py (reported line 189)May include surrounding context.

python

if args.keep_diffs or not passed:
            keep_diff_dir = '.visual-qa/diffs'
            os.makedirs(keep_diff_dir, exist_ok=True)
            subprocess.run(['cp', '-r', f'{diff_dir}/.', keep_diff_dir])
            print(f"📁 Diff images saved to: {keep_diff_dir}")
        
        # Exit with appropriate code

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 79% confidence

Finding

This code writes a .temp-config.json file derived from the user's config, which may include URLs or server settings, but there is no disclosure that an additional config artifact will be created during execution. For code files, file writes should have some visible user disclosure unless they are clearly communicated; here only the later capture step is logged, not the temp file creation itself.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.