Radon AI

• Outcome: Pass
• Latest audit: Sep 10, 2026 · 9:01 PM UTC
• Version: 1.0.0

Overview

This skill is a coherent React Native debugging integration, but its screenshot, log, and network-inspection tools can expose sensitive app data during normal use.

Install this only for React Native or Expo work where you are comfortable letting the agent inspect the active app, logs, screenshots, component hierarchy, and selected network request details. Avoid using it against production accounts or live sensitive data unless you can tolerate headers, bodies, cookies, tokens, and visible app content entering the agent context.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: SKILL.md:35

Finding

Unrestricted Exposure of Sensitive Network Request Data

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 35
Vulnerability Type: Sensitive network data access without documented redaction or authorization controls
Risk Level: Medium

Vulnerable Code Snippet:

markdown

- `view_network_request_details` - Get all details of a specific network request. Returns headers, body, and other metadata for a given request. Use this tool after `view_network_logs` to inspect a specific request in detail. Accepts a `requestId` parameter.

Technical Analysis

The documented tool returns all headers, body content, and metadata associated with a selected network request. These fields may contain bearer tokens, session cookies, API keys, personal information, passwords, or confidential application payloads.

The skill does not document default redaction, field-level filtering, request-scope restrictions, user confirmation, or access controls for unredacted content. This conflicts with least-privilege principles because routine network debugging generally does not require disclosing every sensitive field to the agent.

This finding is limited to the capability and missing safeguards described in SKILL.md. The audited package contains no implementation code demonstrating whether the underlying MCP server applies protections outside this documentation.

Attack Path

1. The agent invokes view_network_logs to enumerate requests generated by the application.
2. The returned list provides an identifier for a request involving authentication or confidential application data.
3. The agent passes that identifier to view_network_request_details.
4. The tool returns the complete request headers, body, and metadata.
5. Sensitive values become available in the agent context and may subsequently be included in generated responses, logs, or retained conversation history.

Impact Assessment

Successful exploitation or accidental misuse could expose authentication toke ...[truncated 548 chars]

Remediation

View remediation

Remediation Suggestions

1. Redact sensitive headers by default, including Authorization, Cookie, Set-Cookie, proxy credentials, API keys, and vendor-specific authentication headers.
2. Recursively mask sensitive body fields such as passwords, tokens, secrets, payment details, and personally identifiable information.
3. Return only metadata and sanitized previews unless the user explicitly authorizes access to an identified request.
4. Require separate, informed confirmation before revealing unredacted request content, clearly identifying the request and the types of sensitive data that may be exposed.
5. Restrict request-detail access to the active project, application, and debugging session.
6. Apply output-size limits and allow field-level selection so agents retrieve only the information necessary for diagnosis.
7. Prevent unredacted values from being written to persistent logs or telemetry, and document retention and deletion behavior.
8. Add automated tests verifying that common credentials and sensitive body fields are consistently masked.
9. Update SKILL.md to explain the redaction policy, authorization process, access boundaries, and safe handling requirements.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The skill explicitly exposes screenshot capture and detailed network request inspection, both of which can reveal sensitive information such as API tokens, session identifiers, personal data, and app content visible on screen. While these capabilities are legitimate for React Native debugging, the description lacks any warning, consent requirement, or data-handling guidance, increasing the risk of accidental overcollection or disclosure.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.