Security audit
Security checks for vulnerabilities and agentic risk
This Pinterest search skill mostly matches its stated purpose, but it needs review because its setup and helper code handle cookies, proxies, downloads, and static-analysis-evasion patterns unsafely.
Install only after review or changes. Avoid using a real Pinterest session cookie with this version, do not copy generated export commands containing untrusted values, install Bun through a safer pinned/verifiable method, and use --download only in a sandboxed environment with limited network and disk access.
SKILL.md:55Remote Installer Is Downloaded and Executed Without Integrity Verification
scripts/configure.ts:12Cookie Handling Exposes Session Secrets and Generates a Shell-Injection Sink
scripts/vendors/image-cache/src/index.ts:91Unrestricted Image Downloads Permit Blind SSRF and Resource Exhaustion
scripts/package.json:5Mutable Dependency Ranges and Missing Lockfile Make Installation Non-Reproducible
The documentation indicates the skill can download arbitrary remote images, cache them locally, possibly transform them, and use proxy-based fetching with multi-domain support, which is meaningfully broader than a Pinterest keyword search. That broadens the attack surface to include SSRF-like proxy misuse, untrusted content retrieval, and storage of arbitrary remote data under the guise of a search skill.
The documentation indicates the skill can download arbitrary remote images, cache them locally, possibly transform them, and use proxy-based fetching with multi-domain support, which is meaningfully broader than a Pinterest keyword search. That broadens the attack surface to include SSRF-like proxy misuse, untrusted content retrieval, and storage of arbitrary remote data under the guise of a search skill.
The documentation indicates the skill can download arbitrary remote images, cache them locally, possibly transform them, and use proxy-based fetching with multi-domain support, which is meaningfully broader than a Pinterest keyword search. That broadens the attack surface to include SSRF-like proxy misuse, untrusted content retrieval, and storage of arbitrary remote data under the guise of a search skill.
The documentation instructs users to fetch and execute a remote installation script directly from the network using curl piped to bash. This is a classic supply-chain and remote-code-execution risk because any compromise of the upstream server, transport, or script contents immediately results in arbitrary code execution on the host.
The explicit use of a shell pipe into bash chains remote content retrieval directly into execution, removing any opportunity for inspection and amplifying the risk of arbitrary command execution. In a skill context, embedding this pattern normalizes unsafe operator behavior and could be reused by agents or users without understanding the consequences.
Referenced artifact was not completely inspected
Use the script at `scripts/pinterest_search.ts`. All TypeScript files must be run with **Bun**:
Referenced artifact was not completely inspected
Use the script at `scripts/pinterest_search.ts`. All TypeScript files must be run with **Bun**:
Referenced artifact was not completely inspected
Use the script at `scripts/pinterest_search.ts`. All TypeScript files must be run with **Bun**:
Referenced artifact was not completely inspected
Use the script at `scripts/pinterest_search.ts`. All TypeScript files must be run with **Bun**:
Referenced artifact was not completely inspected
Use the script at `scripts/pinterest_search.ts`. All TypeScript files must be run with **Bun**:
Referenced artifact was not completely inspected
Use the script at `scripts/pinterest_search.ts`. All TypeScript files must be run with **Bun**:
Referenced artifact was not completely inspected
Use the script at `scripts/pinterest_search.ts`. All TypeScript files must be run with **Bun**:
Referenced artifact was not completely inspected
Use the script at `scripts/pinterest_search.ts`. All TypeScript files must be run with **Bun**:
Referenced artifact was not completely inspected
Use the script at `scripts/pinterest_search.ts`. All TypeScript files must be run with **Bun**:
Referenced artifact was not completely inspected
Use the script at `scripts/pinterest_search.ts`. All TypeScript files must be run with **Bun**:
The comments explicitly state that environment-variable handling is structured to disrupt static taint analysis, which is a strong indicator of deliberate evasion rather than an implementation necessity. Code that is intentionally written to hide data flow from security tooling is dangerous because it undermines review and can conceal misuse of sensitive inputs such as proxies, cookies, or file paths.
An explicit statement that the code is meant to evade static analysis is itself a serious security finding because it demonstrates intent to bypass safeguards. In the context of a skill that handles environment-derived proxy and cookie data, this makes the module substantially more dangerous than an ordinary scraper because reviewers cannot trust that data flows are honestly represented.
The comment says a serialization/deserialization step is used to break taint tracking, directly signaling an intent to obscure how untrusted data moves through the program. Even if the specific transform is functionally harmless, the evasion intent substantially raises the likelihood that unsafe file or network flows are being concealed from automated and human reviewers.
The code comment describing content transformation as a way to break taint tracking indicates purposeful concealment of input flow from security tools. That intent is especially concerning in a skill that reads and writes local files, because it suggests the developer is optimizing for bypassing detection rather than for safe, transparent behavior.
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
# Environment variables
.env
.env.local
.env.*.local
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
# Environment variables
.env
.env.local
.env.*.local
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
# Environment variables
.env
.env.local
.env.*.local
# Node.js
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
# Environment variables
.env
.env.local
.env.*.local
# Node.js
The skill declares access to environment variables, network, and shell-like execution patterns but does not constrain or disclose tool scope via explicit permissions. That increases the chance an agent invokes a capability-rich skill without adequate sandboxing or user awareness, especially since the skill also handles cookies, proxies, filesystem writes, and downloads.
The trigger text is broad enough to activate on generic requests for visual inspiration even when the user did not specifically ask for Pinterest. Over-broad routing is dangerous in agent systems because it can cause accidental invocation of a capability-bearing skill that performs network access, caching, and file writes in contexts where the user only asked for general help.