Security audit

Design Mirror

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly coherent for copying public website styling, but it sends arbitrary target URLs through Bright Data using an API key and disables TLS verification, which creates avoidable credential and privacy risk.

Install only if you are comfortable sending reference URLs and fetched page content to Bright Data. Do not use it on private dashboards, localhost, intranet sites, authenticated pages, or confidential customer/prototype URLs. The scripts should be fixed before use by removing curl -k, validating HTTPS public URLs, and constructing JSON with a proper encoder.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (4)

T09 · Insecure Skill Coding Practices

Error

Location: scripts/scrape_html.sh:25
Finding: TLS Certificate Verification Disabled in HTML Scraper
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/screenshot.sh:25
Finding: TLS Certificate Verification Disabled in Screenshot Capture
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/scrape_html.sh:25
Finding: Unsafe JSON Construction in HTML Scraper
Content: View full analysis
Remediation: View remediation
&2; exit 1 ;; esac REQUEST_BODY="$( jq -n \ --arg zone "$BRIGHTDATA_UNLOCKER_ZONE" \ --arg url "$URL" \ '{zone: $zone, url: $url, format: "raw"}' )" curl --fail-with-body --silent --show-error \ --proto '=https' \ -X POST 'https://api.brightdata.com/request' \ -H "Authorization: Bearer $BRIGHTDATA_API_KEY" \ -H 'Content-Type: application/json' \ --data-binary "$REQUEST_BODY" \ --output "$OUTPUT" ``` - If adding `jq` is undesirable, use another established JSON encoder; do not implement escaping with ad hoc substitutions. ]]>

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/screenshot.sh:25
Finding: Unsafe JSON Construction in Screenshot Capture
Content: View full analysis
Remediation: View remediation
&2; exit 1 ;; esac REQUEST_BODY="$( jq -n \ --arg zone "$BRIGHTDATA_UNLOCKER_ZONE" \ --arg url "$URL" \ '{ zone: $zone, url: $url, format: "raw", data_format: "screenshot" }' )" curl --fail-with-body --silent --show-error \ --proto '=https' \ -X POST 'https://api.brightdata.com/request' \ -H "Authorization: Bearer $BRIGHTDATA_API_KEY" \ -H 'Content-Type: application/json' \ --data-binary "$REQUEST_BODY" \ --output "$OUTPUT" ``` - Validate that the response is a supported image before reporting successful capture. ]]>

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (10)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The skill claims to replicate visual style for a user's codebase, but the concrete instructions focus on screenshotting and scraping arbitrary websites through an external provider rather than safely bounded local design analysis. Because the true behavior is broader than the declared purpose, operators may unknowingly enable a generic web-capture pipeline with credentialed third-party access, which can be abused for unauthorized collection or policy-violating scraping.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The skill claims to replicate visual style for a user's codebase, but the concrete instructions focus on screenshotting and scraping arbitrary websites through an external provider rather than safely bounded local design analysis. Because the true behavior is broader than the declared purpose, operators may unknowingly enable a generic web-capture pipeline with credentialed third-party access, which can be abused for unauthorized collection or policy-violating scraping.
Content: No source excerpt is available for this finding.

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 98% confidence
Finding: Using curl with -k disables TLS certificate validation, allowing man-in-the-middle interception or spoofing of the HTTPS connection to the Bright Data API. Because the request includes a bearer token and user-controlled URL data, an active attacker could steal credentials, alter requests, or return tampered content.
Content: Scanner excerpt · scripts/scrape_html.sh (reported line 25)May include surrounding context.
sh
echo "Scraping HTML from: $URL" >&2 curl -k -s -X POST 'https://api.brightdata.com/request' \ -H "Authorization: Bearer $BRIGHTDATA_API_KEY" \ -H 'Content-Type: application/json' \ -d "{\"zone\":\"$BRIGHTDATA_UNLOCKER_ZONE\",\"url\":\"$URL\",\"format\":\"raw\"}" \

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 98% confidence
Finding: Using curl with -k disables TLS certificate validation, allowing man-in-the-middle interception or modification of the request to the Bright Data API. Because the request carries a bearer token and user-controlled target URL, an attacker on the network path could steal credentials, alter destinations, or return tampered screenshot content.
Content: Scanner excerpt · scripts/screenshot.sh (reported line 25)May include surrounding context.
sh
echo "Capturing screenshot of: $URL" >&2 curl -k -s -X POST 'https://api.brightdata.com/request' \ -H "Authorization: Bearer $BRIGHTDATA_API_KEY" \ -H 'Content-Type: application/json' \ -d "{\"zone\":\"$BRIGHTDATA_UNLOCKER_ZONE\",\"url\":\"$URL\",\"format\":\"raw\",\"data_format\":\"screenshot\"}" \

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 93% confidence
Finding: The skill invokes shell scripts to fetch screenshots and scrape HTML from arbitrary user-supplied URLs, but it declares no tool scope or allowed-tools restrictions. That makes the effective capability broader than advertised and weakens containment, increasing the chance of unintended command execution or unreviewed networked actions in environments that honor explicit tool permissions.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The trigger conditions are extremely broad, causing the skill to activate on ordinary design requests or vague references to another site. In context, that matters because activation can lead to scraping and screenshotting arbitrary URLs via external services, so over-triggering increases the chance of unintended data transfer and unnecessary exposure.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 89% confidence
Finding: The hardcoded external endpoint confirms that all scraping traffic is routed to a third-party API rather than directly to the destination site. In a design-mirroring skill, this increases risk because users may point the tool at arbitrary sites, including internal or proprietary web apps, causing unintended disclosure of target URLs and fetched content to an outside service.
Content: Scanner excerpt · scripts/scrape_html.sh (reported line 25)May include surrounding context.
sh
echo "Scraping HTML from: $URL" >&2 curl -k -s -X POST 'https://api.brightdata.com/request' \ -H "Authorization: Bearer $BRIGHTDATA_API_KEY" \ -H 'Content-Type: application/json' \ -d "{\"zone\":\"$BRIGHTDATA_UNLOCKER_ZONE\",\"url\":\"$URL\",\"format\":\"raw\"}" \

External Transmission

Medium

Category: Data Exfiltration
Confidence: 89% confidence
Finding: The hardcoded external endpoint confirms that all scraping traffic is routed to a third-party API rather than directly to the destination site. In a design-mirroring skill, this increases risk because users may point the tool at arbitrary sites, including internal or proprietary web apps, causing unintended disclosure of target URLs and fetched content to an outside service.
Content: Scanner excerpt · scripts/scrape_html.sh (reported line 25)May include surrounding context.
sh
echo "Scraping HTML from: $URL" >&2 curl -k -s -X POST 'https://api.brightdata.com/request' \ -H "Authorization: Bearer $BRIGHTDATA_API_KEY" \ -H 'Content-Type: application/json' \ -d "{\"zone\":\"$BRIGHTDATA_UNLOCKER_ZONE\",\"url\":\"$URL\",\"format\":\"raw\"}" \

External Transmission

Medium

Category: Data Exfiltration
Confidence: 93% confidence
Finding: The script sends user-supplied URLs and authentication context to a third-party service (Bright Data) to retrieve screenshots. In this skill's context, that means arbitrary user-requested destinations are transmitted off-system, which can expose sensitive internal URLs, trigger outbound access to internal resources through the provider, and create privacy/compliance risks.
Content: Scanner excerpt · scripts/screenshot.sh (reported line 25)May include surrounding context.
sh
echo "Capturing screenshot of: $URL" >&2 curl -k -s -X POST 'https://api.brightdata.com/request' \ -H "Authorization: Bearer $BRIGHTDATA_API_KEY" \ -H 'Content-Type: application/json' \ -d "{\"zone\":\"$BRIGHTDATA_UNLOCKER_ZONE\",\"url\":\"$URL\",\"format\":\"raw\",\"data_format\":\"screenshot\"}" \

External Transmission

Medium

Category: Data Exfiltration
Confidence: 93% confidence
Finding: The script sends user-supplied URLs and authentication context to a third-party service (Bright Data) to retrieve screenshots. In this skill's context, that means arbitrary user-requested destinations are transmitted off-system, which can expose sensitive internal URLs, trigger outbound access to internal resources through the provider, and create privacy/compliance risks.
Content: Scanner excerpt · scripts/screenshot.sh (reported line 25)May include surrounding context.
sh
echo "Capturing screenshot of: $URL" >&2 curl -k -s -X POST 'https://api.brightdata.com/request' \ -H "Authorization: Bearer $BRIGHTDATA_API_KEY" \ -H 'Content-Type: application/json' \ -d "{\"zone\":\"$BRIGHTDATA_UNLOCKER_ZONE\",\"url\":\"$URL\",\"format\":\"raw\",\"data_format\":\"screenshot\"}" \