Security audit

Website ScreenshotOne (by ScreenshotOne)

Security checks for vulnerabilities and agentic risk

Overview

This screenshot skill is mostly coherent, but it needs review because it can send sensitive URLs, screenshots, API keys, and optional session credentials to a third-party service without enough user-facing safeguards.

Install only if you are comfortable sending target URLs and rendered page content to ScreenshotOne. Avoid using cookies, authorization headers, private authenticated pages, or storage uploads unless you intend that third-party exposure, and prefer explicit invocation for each capture.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.md:30
Finding: Sensitive API and Target-Site Credentials Transmitted in URL Query Parameters
Content: View full analysis
" \ --data-urlencode "url=" \ --data-urlencode "access_key=${SCREENSHOTONE_ACCESS_KEY}" \ --data-urlencode "format=png" \ --data-urlencode "=" \ "https://api.screenshotone.com/take" ``` `SKILL.md:93`: ```markdown - Request context: `cookies`, `headers`, `authorization`, `proxy`, `user_agent` ``` `references/screenshotone-options.md:5-10`: ```markdown This file is a compact working reference for direct ScreenshotOne `curl` requests. It does not replace the official docs. Use it to choose request parameters quickly, then pass them through repeated `--data-urlencode "key=value"` flags. ## Required and Core - `access_key`: required API credential - `url`: website to capture ``` `references/screenshotone-options.md:67-70`: ```markdown - `authorization`: auth header helper - `cookies`: cookies to preload - `headers`: custom request headers - `user_agent`: custom user agent ``` ### Technical Analysis The documented command uses `curl --get`, causing every `--data-urlencode` value to be appended to the request URL as a query parameter. This includes the ScreenshotOne `access_key`. The generic option template also allows `cookies`, `authorization`, and `headers` to be passed through the same mechanism. Secrets embedded in URLs have a broader exposure surface than credentials carri ...[truncated 2595 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (7)

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 37)May include surrounding context.
--data-urlencode "url=https://example.com"
--data-urlencode "access_key=${SCREENSHOTONE_ACCESS_KEY}"
--data-urlencode "format=png"
"https://api.screenshotone.com/take"

text
Take a full-page screenshot with a larger viewport:

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 51)May include surrounding context.
--data-urlencode "url=https://example.com"
--data-urlencode "access_key=${SCREENSHOTONE_ACCESS_KEY}"
--data-urlencode "format=png"
"https://api.screenshotone.com/take"

text
Take a full-page screenshot with a larger viewport:

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 66)May include surrounding context.
--data-urlencode "url=https://example.com"
--data-urlencode "access_key=${SCREENSHOTONE_ACCESS_KEY}"
--data-urlencode "format=png"
"https://api.screenshotone.com/take"

text
Take a full-page screenshot with a larger viewport:

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 88)May include surrounding context.
--data-urlencode "url=https://example.com"
--data-urlencode "access_key=${SCREENSHOTONE_ACCESS_KEY}"
--data-urlencode "format=png"
"https://api.screenshotone.com/take"

text
Take a full-page screenshot with a larger viewport:

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The skill enables implicit invocation without any narrowing conditions, so an agent may automatically select it whenever a user mentions screenshots or websites. Because this skill issues direct curl-based external requests and can write output locally, over-broad auto-activation increases the chance of unintended network access, data exfiltration, or use on attacker-supplied URLs without sufficient user confirmation.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 86% confidence
Finding: This markdown file describes using an access_key and later request-context parameters such as authorization, cookies, and headers, plus store=true uploads, but it does not warn that these options can transmit sensitive credentials or page/session data to a third-party service. Under the markdown-file criteria for missing user warnings, omission of privacy or system-integrity cautions around such behaviors is a reportable issue.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 79% confidence
Finding: The file lists styles=<css>, scripts=<js>, click=<selector>, and hover=<selector> as customization options, but does not disclose that script injection and automated interactions may modify page state, trigger actions, or produce side effects on authenticated sessions. For markdown descriptions, missing warnings about behaviors that could affect user data or system integrity should be flagged.
Content: No source excerpt is available for this finding.