Security audit

AR XR Builder

Security checks for vulnerabilities and agentic risk

Overview

The skill is coherent for building Kivicube AR/XR pages, but it recommends broad browser sensor permissions and an unpinned third-party script that users should review before adopting.

Install only if you are comfortable with Kivicube browser integrations. Before using its examples in production, reduce iframe permissions to the minimum needed, remove microphone unless a separately reviewed audio feature requires it, add clear camera/photo notices for users, and consider pinning or self-hosting a reviewed copy of the vendor script with CSP controls.

A.I.G

Vulnerability Patterns

Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T03 · Remote Payload Retrieval and Execution

Warning

Location: SKILL.md:79
Finding: Mutable Third-Party JavaScript Is Executed Without Version or Integrity Pinning
Content: View full analysis
``` `references/integration.md:27`: ```html ``` ### Technical Analysis The recommended integration loads executable JavaScript from a mutable external URL. The URL does not identify an immutable release, and the example provides neither a Subresource Integrity hash nor another mechanism for verifying the downloaded file. Although the script is hosted on the declared Kivicube vendor domain and its use is consistent with the Skill's documented purpose, its effective payload can change after this Skill has been reviewed. A compromise of the vendor infrastructure, CDN, DNS resolution path, or deployment account could therefore turn an otherwise legitimate integration into a remote code-execution channel in every host page following this guidance. Unlike iframe content, an external `
Remediation: View remediation
``` 3. Do not invent or reuse an integrity value. Generate and verify it against a reviewed, approved release. 4. If immutable vendor releases and SRI are unavailable, consider self-hosting an approved copy when licensing and support requirements permit. 5. Pin the approved file checksum in the deployment pipeline and fail builds when the downloaded artifact differs. 6. Apply a restrictive Content Security Policy, limiting `script-src`, `connect-src`, `frame-src`, and other relevant directives to required origins. 7. Monitor vendor security advisories and establish a controlled process for reviewing and updating the pinned plugin version. 8. Apply the hardened loading instructions consistently in both `SKILL.md` and `references/integration.md`. ]]>

T05 · Unauthorized Access and Privilege Escalation

Note

Location: references/integration.md:9
Finding: Iframe Example Delegates Unnecessary Microphone Permission
Content: View full analysis
" allow="xr-spatial-tracking;camera;microphone;autoplay;fullscreen;gyroscope;accelerometer" frameborder="0" > ``` ### Technical Analysis The iframe's Permissions Policy delegates microphone capability to embedded Kivicube content. However, the Skill explicitly limits its stable public surface and excludes audio APIs. The default example therefore grants a capability beyond the documented needs of the covered image-tracking, cloud-AR, and Web3D workflows. The `allow` attribute does not itself bypass the browser's user-consent prompt or operating-system permission controls. It does, however, make microphone access available for the embedded origin to request. This unnecessarily expands the permission boundary and increases the consequences of compromised, malicious, or unexpectedly modified embedded content. The same least-privilege concern may apply to other delegated capabilities depending on the selected scene type. For example, a `web3d` scene may not require camera, microphone, gyroscope, or accelerometer access. ### Attack Path 1. A developer copies the documented iframe example without reducing its permissions. 2. The resulting page delegates microphone capability to Kivicube iframe content. 3. Embedded scene content or compromised upstream content attempts to access the microphone. 4. The browser presents a permission request to the user because the host has allowed that capability to be requested. 5. If the user approves, the embedded content receives microphone input despite microphone access not being required by the documented workflow. 6. The content could process or transmit captured audio subject to browser, operating-system, CSP, and network restrictions. ### Impact Assessme ...[truncated 650 chars]
Remediation: View remediation
" allow="xr-spatial-tracking; camera; autoplay; fullscreen; gyroscope; accelerometer" frameborder="0" > ``` 2. Tailor permissions to the selected scene type rather than using one broad permission list: - For `web3d`, omit camera, microphone, gyroscope, and accelerometer unless a separately reviewed feature requires them. - For camera-based AR, delegate camera access but omit unrelated capabilities. - Delegate gyroscope or accelerometer only when the scene demonstrably depends on motion sensors. 3. Add microphone capability only for a separately documented and approved audio requirement. 4. Explain why each requested capability is necessary and request access only in response to an explicit user action. 5. Test reduced permission sets on supported browsers and devices to identify the minimum functional policy. 6. Where practical, enforce a restrictive host-level `Permissions-Policy` header in addition to the iframe's `allow` attribute. ]]>

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (4)

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The examples demonstrate camera access and photo capture flows, including api.takePhoto() and handling isUserDeniedCamera, but the surrounding markdown does not warn implementers to present a clear user-facing notice before invoking camera-dependent AR features. In a copy-paste example file, this omission can propagate privacy-hostile integrations where users are surprised by camera use or do not understand why photos are being captured, increasing consent and compliance risk.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 83% confidence
Finding: The embed example requests camera and microphone permissions via the iframe allow attribute, which can affect user privacy. The document explains technical setup but does not explicitly warn readers that integrating this embed may prompt for access to those sensors or that hosts should disclose this behavior to users.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The instruction to use this file when a question is about broad topics like rendering state, camera parameters, or custom photo flows is an activation description in a markdown file, and it lacks clear scope boundaries or exclusion examples. Several terms are high-level and could overlap with many unrelated graphics questions, making invocation criteria ambiguous.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 87% confidence
Finding: The file documents takePhoto() and notes that AR output may composite the device camera feed with 3D content, but it does not warn that the resulting image may contain privacy-sensitive real-world imagery or bystanders. In an AR/XR skill focused on camera-based experiences, omission of privacy guidance can lead downstream agents or developers to implement capture/export flows without adequate user notice, consent, or handling safeguards.
Content: No source excerpt is available for this finding.