T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/coupang.js:47- Finding
Unrestricted User-Controlled Browser Navigation
- Content
View full analysis
- Remediation
View remediation
Security audit
Korean Scraper
Security checks for vulnerabilities and agentic risk
Overview
This appears to be a real Korean-site scraper, but it weakens browser protections and can load arbitrary user-supplied URLs, so it needs careful review before installation.
Install only if you are comfortable running a scraper with anti-bot features. Use it in an isolated, unprivileged container or VM with outbound network access limited to the intended public domains, avoid running it on networks with sensitive internal web services, and review site terms, copyright, privacy, and account-risk implications before collecting data.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T09 · Insecure Skill Coding Practices
Error
- Location
lib/common.js:17- Finding
Chromium Sandbox and Origin-Isolation Protections Disabled
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (33)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 92% confidence
- Finding
The documentation advertises a broad anti-bot-capable multi-site scraper, but the evidence presented is indirect and narrower. In a security context, inflated claims about supported targets and stealth protections can cause operators to trust the skill in scenarios it was not reviewed for, increasing misuse and policy bypass risk.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
The documentation advertises a broad anti-bot-capable multi-site scraper, but the evidence presented is indirect and narrower. In a security context, inflated claims about supported targets and stealth protections can cause operators to trust the skill in scenarios it was not reviewed for, increasing misuse and policy bypass risk.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
The documentation advertises a broad anti-bot-capable multi-site scraper, but the evidence presented is indirect and narrower. In a security context, inflated claims about supported targets and stealth protections can cause operators to trust the skill in scenarios it was not reviewed for, increasing misuse and policy bypass risk.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 96% confidence
- Finding
The documentation advertises a broad anti-bot-capable multi-site scraper, but the evidence presented is indirect and narrower. In a security context, inflated claims about supported targets and stealth protections can cause operators to trust the skill in scenarios it was not reviewed for, increasing misuse and policy bypass risk.
- Content
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md node scripts/naver-cafe.js popular "카페URL" --limit 20
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md node scripts/naver-cafe.js popular "카페URL" --limit 20
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md node scripts/naver-cafe.js popular "카페URL" --limit 20
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md node scripts/coupang.js product "상품URL"
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md node scripts/coupang.js product "상품URL"
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md node scripts/coupang.js product "상품URL"
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 77% confidence
- Finding
The skill documents use of environment variables such as HEADLESS, SCREENSHOT, WAIT_TIME, and USER_AGENT, but it does not declare any explicit tool scope or permissions. Missing scope boundaries make it harder for a host agent to reason about what external capabilities the skill needs and can enable over-broad execution in environments that enforce least privilege.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The skill facilitates collection and storage of third-party content from news, blogs, cafes, and product pages, but the description does not prominently warn about privacy, copyright, or terms-of-service risks. In the context of a scraper with anti-bot features, lack of user-facing warnings makes misuse more likely and reduces informed consent around legal exposure.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
The skill description and all operational guidance are written entirely in Korean and framed as a Korean-specialized scraper, with no indication that users can opt for another language or that the locale restriction is intentional for a region-specific audience. Under the language/locale policy, forcing a specific language without user opt-in can be a natural-language policy issue.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 82% confidence
- Finding
The installation instructions use 'npx playwright' without a pinned version, which can pull a newer package at runtime than the one reviewed or tested. This creates a supply-chain and reproducibility risk, especially for browser automation packages that execute substantial code during install and runtime.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The anti-bot section describes deliberate evasion techniques, including webdriver hiding and stealth plugins, without a direct warning that these behaviors may violate site rules or trigger blocks. Because the skill context is web scraping against defended services, this omission materially increases the risk of abuse, account restriction, IP blocking, or policy violations.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The skill claims robots.txt compliance while also documenting anti-bot evasion measures such as hiding navigator.webdriver, stealth plugins, and Cloudflare bypass behavior. These positions are contradictory and can mislead users into believing the tool is policy-safe while it is explicitly designed to evade site defenses, increasing legal, operational, and abuse risk.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
This code forces the browser context and Accept-Language headers to Korean values ('ko-KR', 'Asia/Seoul') for all uses. The policy allows locale constraints only when users can opt in or when the restriction is clearly documented and justified; this file provides neither.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 93% confidence
- Finding
The install script invokes
npx playwright install chromiumwithout pinning the package version in the command, so the resolved CLI can vary based on registry state or environment and may execute unintended code during installation. Because install scripts run automatically in many environments, this creates a supply-chain risk if a malicious or compromised package version is fetched.- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The extractArticle function accepts any user-supplied URL and immediately loads it in a browser context, even though the skill is described as a Daum news scraper. This expands the trust boundary from Daum-only content to arbitrary external sites, enabling misuse as a general-purpose scraper and increasing exposure to untrusted pages, unexpected data collection, and policy bypass.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
After navigating to an arbitrary URL, the script scrapes title, author, content, category, and image URLs from whatever page matches the generic selectors. In context, this makes a Daum-specific skill capable of collecting content from unrelated websites, which is an overbroad capability and can be repurposed for unauthorized data extraction or interaction with untrusted sites.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The extractBlog function accepts a user-supplied URL and sends it directly to page.goto() without restricting it to blog.naver.com. That turns a Naver-specific scraper into an arbitrary stealth web fetcher, which can be abused for unauthorized crawling, access to internal-only endpoints reachable from the runtime environment, or bypassing organizational controls through automated browser access.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
Because createStealthBrowser() is combined with unrestricted navigation, this script can be repurposed as a generic stealth browser for arbitrary domains rather than only Naver blogs. In the context of an agent skill advertising anti-bot scraping, that materially increases abuse potential by enabling stealthy automated access against unrelated sites and expanding the blast radius beyond the declared scope.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The extractArticle function accepts any user-supplied URL and fetches it in a browser context without restricting it to Naver domains. In an agent or automation setting, this can be abused as an SSRF-style network primitive to reach unintended external or internal endpoints, especially because the skill is presented as a Naver-specific scraper.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The script transmits arbitrary user-provided URLs over the network via page.goto with no validation, warning, or consent boundary. In a larger agent environment, this can cause unintended requests to attacker-chosen destinations, leak network reachability, or be repurposed for probing services the user did not intend to contact.
- Content
Unpinned Dependencies
Low
- Category
- Supply Chain
- Confidence
- 89% confidence
- Finding
Using caret ranges for
playwrightallows newer minor/patch releases to be installed than were originally tested, which weakens build reproducibility and increases exposure to supply-chain compromise or unexpected security regressions. In a package that automates browser installation and scraping, dependency drift is more sensitive because the toolchain executes substantial third-party code.- Content
json "author": "무펭이", "license": "MIT", "dependencies": { "playwright": "^1.41.0", "playwright-extra": "^4.3.6", "puppeteer-extra-plugin-stealth": "^2.11.2" }
Static analysis
Detected: suspicious.dynamic_code_execution
Dynamic code execution detected.
Critical
- Code
- suspicious.dynamic_code_execution
- Location
- scripts/coupang.js:117
Dynamic code execution detected.
Critical
- Code
- suspicious.dynamic_code_execution
- Location
- scripts/daum-news.js:51
Dynamic code execution detected.
Critical
- Code
- suspicious.dynamic_code_execution
- Location
- scripts/naver-blog.js:50
Dynamic code execution detected.
Critical
- Code
- suspicious.dynamic_code_execution
- Location
- scripts/naver-cafe.js:62
Dynamic code execution detected.
Critical
- Code
- suspicious.dynamic_code_execution
- Location
- scripts/naver-news.js:51