Security audit

Flexible Web Tester

Security checks across malware telemetry and agentic risk

Overview

This web-testing skill is mostly coherent, but it asks for broad browser, terminal, filesystem, and login access without enough safeguards for credentials, saved artifacts, or real website actions.

Install only if you are comfortable granting the agent filesystem, terminal, and browser-control access. Use staging sites and disposable test accounts, prefer manual login, inspect generated scripts before confirming execution, choose a dedicated output folder, and redact or delete reports/screenshots that may contain private page content.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (7)

Missing User Warnings

Low

Confidence: 86% confidence
Finding: The README explicitly advertises automatic local saving of test plans and reports, but it does not describe where files are written, what data may be persisted, or how to avoid overwriting sensitive paths. In a skill that uses File System MCP and may process site content, prompts, and credentials, undocumented automatic writes can lead to unintended storage of sensitive data on the user's machine.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The README includes an example with a plaintext username and password in the prompt, normalizing unsafe handling of secrets. In this skill, those credentials could be echoed into chat history, generated scripts, logs, or auto-saved reports, increasing the chance of credential leakage beyond the immediate test session.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The skill explicitly supports automatic login by asking the user to provide a username and password, but it provides no privacy warning, no minimization guidance, and no restriction on how those credentials may be handled. In this skill's broader workflow, those same credentials are then likely to be embedded into generated steps, scripts, and reports, which materially increases the chance of credential exposure.

Vague Triggers

Medium

Confidence: 89% confidence
Finding: The trigger conditions are broad enough to activate on routine discussion of website testing, Playwright, E2E, or generic phrases like 'test website' or 'test page.' Because this skill performs environment probing, file writes, browser control, terminal execution, and credential handling, accidental invocation can cause unintended sensitive actions or data collection in contexts where the user only wanted advice.

Ssd 3

High

Confidence: 99% confidence
Finding: The skill instructs the agent to accept usernames and passwords from the user and then generate test steps or Python scripts that include those values, such as filling login fields with a literal password. This creates a direct path for secrets to be stored in plaintext in local files, terminal history, logs, and potentially downstream reports, enabling credential theft or reuse if those artifacts are accessed.

Ssd 3

High

Confidence: 98% confidence
Finding: The skill mandates saving generated plans or scripts to local disk before execution, and those artifacts may include target URLs, authentication details, internal workflows, or other private test data. Because persistence is compulsory rather than optional and there is no redaction or secure storage requirement, sensitive information can be exposed to other local users, backups, sync tools, or later accidental disclosure.

Ssd 3

Medium

Confidence: 93% confidence
Finding: The report-generation instructions require detailed execution records, including login handling mode, step-by-step actions, failures, screenshots, and logs, which can inadvertently capture usernames, passwords, session identifiers, or sensitive page content. In a web-testing context, screenshots and execution traces often contain highly sensitive data, so mandatory reporting without sanitization creates a meaningful disclosure risk.

VirusTotal

63/63 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.