Security audit

Bunpro

Security checks for vulnerabilities and agentic risk

Overview

The skill appears to be a real Bunpro sync/reporting tool, but it asks users to handle a live browser session token with broader and under-disclosed account access risk.

Review this before installing if you are not comfortable extracting and giving a local script your Bunpro browser session token. Prefer using an environment variable rather than --token, avoid running it on shared or logged systems, store the database in a private directory, and treat the token as account access until it expires or the session is revoked.

A.I.G

Vulnerability Patterns

Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (3)

T05 · Unauthorized Access and Privilege Escalation

Warning

Location: SKILL.md:38
Finding: Frontend Session Token Exceeds the Skill's Read-Only Privilege Requirements
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/sync.py:392
Finding: Frontend Session Token Can Be Exposed Through Command-Line Arguments
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Note

Location: scripts/sync.py:392
Finding: Environment Variable Name Mismatch Breaks the Advertised Secure Credential Path
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (17)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: The declared description says the skill syncs Bunpro progress from the API to local storage. However, the supplied code only opens an existing local SQLite database and runs read-only queries to display reports. It explicitly errors if the database does not already exist and tells the user to run sync.py first, confirming that syncing is handled elsewhere. The analysis and insight functionality mentioned in the description is partially consistent with the reports produced here, but the core declared purpose of syncing from the API is not represented by this code chunk. Therefore this is a material description-behavior mismatch.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 92% confidence
Finding: The description is mostly aligned with the general intent: this is a Bunpro sync tool that uses the frontend API and stores data locally in SQLite. However, there are material gaps and scope differences. First, the tool does more than syncing grammar learning progress: it fetches user account/profile details and multiple user statistics endpoints. Second, despite defining a grammar_points table, no code populates grammar point content, so the implementation does not fully match a description centered on grammar progress data. Third, review history data is fetched but not written to the local database, which weakens the claim that it stores progress data locally for later analysis. These are meaningful description-to-behavior discrepancies, though the overall domain and high-level purpose are related.
Content: No source excerpt is available for this finding.

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 80% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · references/api-structure.md (reported line 257)May include surrounding context.
md
`POST /bookmarks` #### Delete Bookmark `DELETE /bookmarks/{bookmarkId}` ## Grammar Points

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The script tells users how to extract a live bearer token from browser storage or network headers but does not warn that this credential is sensitive and may grant broad account API access. In a community-distributed skill, normalizing manual token extraction increases the likelihood of credential mishandling, accidental disclosure in shells/logs, or reuse in insecure contexts.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 87% confidence
Finding: The skill declares environment-variable and network-dependent behavior but does not define an explicit tool or permission scope. That ambiguity can cause an agent platform to over-grant capabilities or hide from users that the skill will access sensitive credentials and make outbound authenticated requests.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill instructs users to extract a live frontend bearer token from browser storage, cookies, local storage, or request headers, but does not clearly emphasize that this credential is highly sensitive and equivalent to account access. Users may paste it into shells, logs, screenshots, chat, or version control, leading to account compromise if exposed.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The documentation explicitly instructs users to extract a browser Bearer token from DevTools, local storage, or network traffic, which is a highly sensitive session credential. That guidance normalizes unsafe credential handling and could enable account takeover if the token is exposed, reused, logged, or pasted into untrusted tooling.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 92% confidence
Finding: This example combines external transmission with direct use of a browser-extracted Bearer token in a curl command, encouraging users to handle and transmit a live session credential outside the original application context. Even over HTTPS, this can expose the token via shell history, logs, screenshots, clipboard managers, or unsafe third-party environments.
Content: Scanner excerpt · references/api-structure.md (reported line 14)May include surrounding context.
The API requires a Bearer token obtained from the browser:

bash
curl "https://api.bunpro.jp/api/frontend/user" \ -H "Authorization: Bearer <token_from_browser>"

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 195)May include surrounding context.
md
import requests API_BASE = "https://api.bunpro.jp/api/frontend" DB_FILENAME = "bunpro.db"

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · references/api-structure.md (reported line 5)May include surrounding context.
md
import requests API_BASE = "https://api.bunpro.jp/api/frontend" DB_FILENAME = "bunpro.db"

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · scripts/sync.py (reported line 19)May include surrounding context.
python
import requests API_BASE = "https://api.bunpro.jp/api/frontend" DB_FILENAME = "bunpro.db"

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: This code persists account-derived user data locally, including username, level, XP, and related progress fields. Although the module docstring says data is stored locally for analysis, there is no user-facing warning at runtime before writing potentially sensitive personal data to bunpro.db.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The manifest and module docstring describe syncing Bunpro progress to local storage for analysis, and the database schema even defines a review_histories table. However, sync_review_histories() only performs API GET requests and returns the responses in memory; it never inserts anything into SQLite, so this documented sync behavior is not actually implemented.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The docstring Sync review session history. indicates behavior parallel to the other sync methods, which write fetched data into local SQLite tables. In reality, this function only retrieves two API endpoints and returns them in a dictionary, contradicting the stated intent of syncing history.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 86% confidence
Finding: The skill states that personal learning progress and account-related information will be synced into a local SQLite database, but it does not clearly warn that this creates an on-disk copy of potentially sensitive personal data. Users may run it on shared systems, synced folders, or insecure backups without understanding the privacy implications.
Content: No source excerpt is available for this finding.

Excessive Permissions

Low

Category: Privilege Escalation
Confidence: 80% confidence
Finding: Skill requests more permissions than appear necessary for its stated functionality. Review if elevated access is justified.
Content: Scanner excerpt · SKILL.md (reported line 199)May include surrounding context.
md
- **Auth:** Bearer JWT token from browser (not settings API key) - **Rate limits:** Unknown - be reasonable - **Stability:** Community-documented, may change without notice - **Permission:** Reverse-engineered with permission from Bunpro team ## Troubleshooting

Excessive Permissions

Low

Category: Privilege Escalation
Confidence: 80% confidence
Finding: Skill requests more permissions than appear necessary for its stated functionality. Review if elevated access is justified.
Content: Scanner excerpt · references/api-structure.md (reported line 288)May include surrounding context.
md
- **Auth:** Bearer JWT token from browser (not settings API key) - **Rate limits:** Unknown - be reasonable - **Stability:** Community-documented, may change without notice - **Permission:** Reverse-engineered with permission from Bunpro team ## Troubleshooting

Static analysis

No suspicious patterns detected.