T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/xe-rate.mjs:7- Finding
Hardcoded CDP Authentication Token in Source Code
- Content
View full analysis
- Remediation
View remediation
Security audit
Exchange Rates
Security checks for vulnerabilities and agentic risk
Overview
This exchange-rate skill is mostly purpose-aligned, but it embeds a browser-control token and can use a shared browser session beyond what a rate lookup needs.
Review before installing. The skill appears intended to fetch exchange rates, not steal data, but it should remove the embedded CDP token, create an isolated browser context per run, avoid closing shared browser resources, and make the fallback data source clear in user-facing responses.
Vulnerability Patterns
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)
T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
scripts/xe-rate.mjs:25- Finding
Unnecessary Access to a Shared Browser Context
- Content
View full analysis
{}); ``` ### Technical Analysis The script selects the first existing browser context whenever one is available. An existing context may belong to another invocation or workload and can contain unrelated pages, cookies, local storage, session storage, and authenticated website sessions. Fetching a public exchange rate does not require access to an existing context. The minimum necessary privilege is a new, isolated context containing only the page created for the current lookup. Reusing `browser.contexts()[0]` unnecessarily crosses an isolation boundary and may cause the request to XE.com to include cookies already stored for that domain. The script later calls `browser.close()` rather than tracking and closing only the page and isolated context created for the lookup. Depending on the CDP service and Playwright connection behavior, this can affect other workloads using the shared browser service. The reviewed implementation does not explicitly enumerate or exfiltrate unrelated browser data, so this finding concerns excessive access and unsafe isolation rather than confirmed data theft. ### Attack Path 1. Another browser workload creates a context containing pages, cookies, storage, or authenticated sessions. 2. The exchange-rate Skill connects to the same CDP browser service. 3. The expression `browser.contexts()[0]` selects the pre-existing shared context. 4. The Skill receives the ability to create pages in, and programmatically interact with, that c ...[truncated 1108 chars]- Remediation
View remediation
{}); if (context) await context.close().catch(() => {}); // Disconnect from the remote service without terminating a shared browser, // using the lifecycle operation supported by the deployed CDP service. } ``` The deployment should verify the exact disconnect semantics of its Playwright and CDP service versions so cleanup cannot terminate a browser owned by another workload. ]]>
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (5)
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 89% confidence
- Finding
The skill invokes a network-capable script that uses Playwright/Browserless and a fallback external API, but the manifest does not declare any tool scope or allowed tools. This creates a governance gap: the agent may perform outbound network access beyond what is explicitly authorized or reviewed, making it harder to enforce least privilege and audit external data flows.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
A hardcoded CDP WebSocket token exposes a reusable secret in source code and enables unauthorized parties with code access to connect to the browserless endpoint. Because CDP grants powerful browser control, misuse could allow session access, arbitrary browsing, request interception, or pivoting into internal resources reachable from that browser environment.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The manifest specifically describes this skill as fetching live exchange rates from XE.com, but the implementation includes a separate fallback to open.er-api.com / exchangerate-api.com when XE scraping fails. That means the actual data source and behavior differ from the stated skill description and expected source semantics.
- Content
Intent-Code Divergence
Low
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The top-level comment describes the script as fetching rates from XE.com via Playwright, which contradicts the implemented fallback path that returns exchangerate-api.com data. This is an active documentation mismatch about the skill's actual behavior and source of truth.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The script fetches exchange-rate data from third-party services using both Playwright page navigation and a direct HTTP fetch. Although network access is central to the script's purpose, there is no explicit warning that user-supplied currency/amount parameters will be sent to external services.
- Content
Static analysis
No suspicious patterns detected.