Security audit

Web Pilot

Security checks for vulnerabilities and agentic risk

Overview

This web automation skill largely matches its stated purpose, but it needs Review because it gives broad browser and download authority with unsafe defaults and weak local controls.

Review this skill carefully before installing. It is a powerful browser automation tool, not just a reader: use it only in isolated environments or with trusted tasks, avoid authenticated or sensitive websites unless you are supervising actions, do not submit forms without explicit review, avoid secrets in search queries, and treat downloaded files as untrusted. The download and persistent-browser implementation should be hardened before use in shared or high-trust environments.

A.I.G

Vulnerability Patterns

Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Tool Hijacking and SpoofingModifies or replaces tools so legitimate-looking calls execute attacker logic
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads

Findings (6)

T09 · Insecure Skill Coding Practices

Error

Location: scripts/download_file.py:44
Finding: Arbitrary File Write Through Unsanitized Download Filenames
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/download_file.py:114
Finding: Automatic Fallback to Unverified TLS Connections
Content: View full analysis
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

Location: scripts/download_file.py:114
Finding: Unrestricted URL Navigation Enables Server-Side Request Forgery
Content: View full analysis
Remediation: View remediation

T07 · Tool Hijacking and Spoofing

Error

Location: scripts/browser_session.py:188
Finding: Unauthenticated Shared Unix Socket Permits Browser Session Hijacking
Content: View full analysis
str: sock = socket.socket(socket.AF_UNIX, socket.SOCK_STREAM) sock.settimeout(60) sock.connect(SOCKET_PATH) _send_msg(sock, json.dumps(cmd).encode()) result = _recv_msg(sock) sock.close() return result.decode("utf-8", errors="replace") ``` ### Technical Analysis The persistent browser server uses a fixed socket path: ```python SOCKET_PATH = "/tmp/web-pilot-browser.sock" ``` Commands are trusted solely because they arrive over that socket. The protocol has no authentication token, peer-credential verification, authorization checks, or per-session secret. The code also does not explicitly place the socket in a private runtime directory or set its permissions to mode `0600`; effective accessibility therefore depends on the process umask and surrounding environment. Any local process able to connect can invoke the full command set, including navigation, page extraction, form filling, clicks, screenshots, PDF export, and arbitrary JavaScript evaluation in the current page context. ...[truncated 1403 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/browser_session.py:263
Finding: Insecure Temporary Filename Creation During Range Screenshots
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: SKILL.md:12
Finding: Unpinned Executable Third-Party Dependencies
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Memory PoisoningPersistent Context Injection, Context Window Stuffing, Memory Manipulation
Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (25)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: A substantial description-behavior mismatch is a security problem because operators may authorize the skill based on the documented behavior while the implementation exposes additional capabilities such as arbitrary JavaScript execution, form input, or other browser actions. This can enable unintended website interaction, data submission, or broader browser-driven actions under false assumptions about what the skill does.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: A substantial description-behavior mismatch is a security problem because operators may authorize the skill based on the documented behavior while the implementation exposes additional capabilities such as arbitrary JavaScript execution, form input, or other browser actions. This can enable unintended website interaction, data submission, or broader browser-driven actions under false assumptions about what the skill does.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: A substantial description-behavior mismatch is a security problem because operators may authorize the skill based on the documented behavior while the implementation exposes additional capabilities such as arbitrary JavaScript execution, form input, or other browser actions. This can enable unintended website interaction, data submission, or broader browser-driven actions under false assumptions about what the skill does.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The skill is described as a browsing/extraction utility, but it also exposes an eval action that executes arbitrary JavaScript in any loaded page context. This materially expands capability from passive reading to active page-side code execution, enabling actions such as DOM manipulation, token extraction from page-accessible state, triggering authenticated workflows, or bypassing higher-level safety expectations about what the tool can do.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: On SSL errors, the code retries the request with verify=False, disabling certificate validation and allowing man-in-the-middle interception or content tampering. Because this tool downloads files and may extract PDF text from them, accepting unverified HTTPS content directly undermines the integrity and authenticity of the data being saved and processed.
Content: No source excerpt is available for this finding.

Context Window Stuffing

Medium

Category: Memory Poisoning
Confidence: 85% confidence
Finding: Skill attempts to fill the context window with filler content, displacing legitimate instructions and safety constraints. This can degrade agent performance or bypass safety boundaries.
Content: Scanner excerpt · README.md (reported line 14)May include surrounding context.
md
- **Screen reading on steroids** — extracts clean, structured text from any webpage, stripping away visual clutter, ads, and navigation noise - **Voice-driven browsing** — when paired with an AI assistant, users can browse the web entirely through natural language ("scroll down", "click Sign In", "read me the Overview section") - **Targeted content extraction** — grab specific sections, search for text, or screenshot regions without needing to visually scan a page - **Form interaction** — fill inputs and submit forms via commands, removing the need for precise mouse/keyboard control - **Cookie banner removal** — automatically dismisses consent popups that are notoriously difficult for screen readers ## Features

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: Automatically dismissing cookie banners can silently make or alter privacy consent choices on behalf of the user, especially when the implementation clicks broad 'accept' patterns. In an accessibility-focused agent skill, this is more sensitive because the agent is acting on behalf of users who may not be able to independently verify what consent decision was made.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The README advertises browser automation features that can click, fill, submit forms, and execute arbitrary JavaScript without any safety boundary or warning about side effects. In an agent context, these capabilities can cause unintended state-changing actions on third-party sites, account misuse, or execution of harmful page-context scripts if invoked without explicit user confirmation.
Content: No source excerpt is available for this finding.

Context Window Stuffing

Medium

Category: Memory Poisoning
Confidence: 85% confidence
Finding: Skill attempts to fill the context window with filler content, displacing legitimate instructions and safety constraints. This can degrade agent performance or bypass safety boundaries.
Content: Scanner excerpt · README.md (reported line 187)May include surrounding context.
md
| `click <target>` | Click by CSS selector, text, or button/link role | | `scroll <dir\|sel>` | Scroll down/up or to a CSS selector | | `wait <sec\|sel>` | Wait seconds or for element to appear | | `fill <sel> <val>` | Fill input field (optional `--submit`) | | `back` / `forward` / `reload` | Navigation history | | `eval <js>` | Execute JavaScript, return result | | `links` | Extract all links (href + text) |

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 92% confidence
Finding: The skill advertises network access and local file-writing behavior (downloads, screenshots) but does not declare any explicit tool scope such as permissions or allowed-tools. That omission weakens enforcement and user awareness, making it easier for the skill to be invoked in contexts where network and filesystem side effects are not expected.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The skill describes automatic cookie-banner dismissal and clicking behavior without a clear warning that it may interact with third-party websites on the user's behalf. In context, that increases the risk of unintended consent, accidental form interaction, or policy violations during browsing sessions.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The code automatically clicks cookie consent elements without informing the user or obtaining approval. That can silently alter privacy preferences, accept tracking, or interact with consent dialogs in ways the user did not intend, especially on regulated or sensitive sites.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The fill action supports entering data into arbitrary form fields and optionally submitting them, which exceeds a read-only or browse-oriented tool description. In context, this turns the browser session into an action-taking agent that can post data to websites, initiate workflows, or interact with authenticated sessions without an explicit trust boundary or confirmation step.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: Form filling and optional submission occur with no user-facing confirmation, despite being state-changing web interactions. In a persistent visible browser, this can cause unintended account actions, data disclosure to third parties, or accidental submissions if the session is authenticated or handling sensitive information.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The script accepts an arbitrary --proxy value and passes it directly to requests for both HTTP and HTTPS traffic, allowing all downloads to be routed through an operator- or attacker-controlled intermediary. In a web-browsing/download skill, this expands the network trust boundary and can expose requested URLs, downloaded content, metadata, and potentially enable manipulation of non-TLS traffic or traffic sent after TLS-verification fallback.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: This code performs a network request to an arbitrary URL and writes the response to disk, which are safety-relevant operations under the warning criteria for code files. Although the module docstring describes usage, it does not clearly warn that remote content will be fetched and saved locally, and there is no confirmation prompt before these actions.
Content: No source excerpt is available for this finding.

Unsafe Defaults

Medium

Category: Tool Misuse
Confidence: 99% confidence
Finding: The unsafe default verify=False disables HTTPS certificate verification during retry, making secure transport effectively optional under failure conditions. This creates a straightforward avenue for interception and response modification by any network adversary able to trigger or exploit certificate validation problems.
Content: Scanner excerpt · scripts/download_file.py (reported line 124)May include surrounding context.
python
except requests.exceptions.SSLError: # Retry without SSL verification if certs are broken resp = requests.get(url, headers=headers, timeout=30, stream=True, allow_redirects=True, proxies=proxies, verify=False) resp.raise_for_status() if not filename:

External Transmission

Medium

Category: Data Exfiltration
Confidence: 87% confidence
Finding: This script transmits user-provided search queries to third-party search engines over the network. In the context of an agent skill, queries may contain sensitive user data, internal identifiers, or secrets, so external transmission creates privacy and data leakage risk even though the behavior is expected for a web-search tool.
Content: Scanner excerpt · scripts/google_search.py (reported line 40)May include surrounding context.
python
form_data = {"q": query} for page in range(pages): resp = requests.post("https://html.duckduckgo.com/html/", data=form_data, headers=HEADERS, timeout=15) resp.raise_for_status() soup = BeautifulSoup(resp.text, "html.parser")

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The script programmatically clicks cookie/consent controls across the main frame and iframes without user awareness or consent. In a browsing automation skill, this can silently alter privacy choices, accept broader tracking than intended, and create compliance and trust issues, especially because the skill is designed to operate on arbitrary third-party sites.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 88% confidence
Finding: This markdown file documents a download capability that saves remote content to a local directory, including a default output path. While the feature is expected, the description does not include any caution that it writes files to disk or that users should verify destination paths and downloaded content.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The skill supports downloading files and saving screenshots, both of which write data to the local filesystem, but the description does not clearly warn about those side effects. This can surprise users, create data-handling issues, or lead to storage of untrusted content in environments that assumed read-only behavior.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The skill hard-codes locale="en-US", which imposes a specific language/locale setting on all browser sessions. There is no user opt-in, alternative locale selection, or documented region-specific justification for this restriction.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The request headers hard-code Accept-Language to en-US,en;q=0.9, which imposes a specific language/locale on all searches. This matches the policy concern for language/locale constraints because the script does not provide any user opt-in or configuration for locale selection.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The Google-specific query parameters include hl: en, which explicitly forces English-language results. The script does not document this as a justified region-specific requirement or give users a way to choose another locale.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The code hard-codes locale="en-US" for all browsing sessions, which imposes a specific locale regardless of the user's preferences. There is no option to select a locale or documentation justifying why an English US locale is required.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.