Church Account

• Outcome: Review
• Latest audit: Sep 10, 2026 · 8:21 PM UTC
• Version: 1.0.0

Overview

This skill is for a sensitive church account workflow, but it gives broad automation instructions that include stealth browsing and unsafe session handling.

Review carefully before installing. Only use this with accounts and church data you are authorized to access, avoid stealth or detection-bypass techniques, remove the no-sandbox browser flag, and do not store reusable session tokens in shared temporary paths. Sensitive reads or changes should be narrowly scoped and confirmed by the user each time.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (3)

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:32
• Finding: Chromium Sandbox Disabled During Processing of Remote Content<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 32-35 **Vulnerability Type**: T09: Insecure Skill Coding Practices **Risk Level**: High ### Vulnerable Code ```python browser = await p.chromium.launch( headless=True, args=["--no-sandbox", "--disable-blink-features=AutomationControlled", "--disable-dev-shm-usage"] ) ``` ### Technical Analysis The Playwright example launches Chromium with the `--no-sandbox` option. Chromium's sandbox isolates renderer processes that handle untrusted remote website content from the host operating system. Disabling it removes a critical defense-in-depth boundary and is not necessary for the declared authentication workflow. The browser processes content from authentication and account-management services while credentials and authenticated session data are present in the automation environment. If a visited page, third-party resource, or compromised service exploits a browser vulnerability, the absence of the sandbox can substantially increase the resulting access to the host. ### Attack Path 1. A user runs the documented automation against the remote service. 2. Chromium starts with its sandbox disabled. 3. The browser loads remote pages and associated third-party resources. 4. A compromised or malicious resource exploits a Chromium renderer vulnerability. 5. Because the browser sandbox is disabled, the exploit has fewer isolation boundaries to overcome. 6. The attacker may access resources available to the browser process, including credentials in memory, authenticated state, local files permitted to the process, and the automation environment. ### Impact Assessment Successful exploitation could compromise the account credentials or reusable authentication tokens handled by the process. Depending on the privileges and environment under which Playwright runs, impact may extend to local files, environment variables, and other host resources accessible to that process. The affected account may ...[truncated 192 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Remove the `--no-sandbox` Chromium argument and retain Chromium's normal process isolation. - Run the browser as a dedicated, unprivileged operating-system user. - If sandbox disabling is unavoidable because of platform constraints, execute the browser in a disposable, tightly restricted container or virtual machine. - Restrict the container's filesystem mounts, Linux capabilities, network access, and access to host environment variables. - Keep Chromium and Playwright fully patched. - Do not expose unrelated credentials, files, or services to the browser process. - Terminate and discard the isolated environment after each sensitive automation session. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:27
• Finding: Reusable Authentication State Stored in a Predictable Temporary File<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 27-64 **Vulnerability Type**: T09: Insecure Skill Coding Practices **Risk Level**: High ### Vulnerable Code ```python async def login(target_url="https://lcr.churchofjesuschrist.org", cookies_path="/tmp/church_cookies.json"): async with async_playwright() as p: browser = await p.chromium.launch( headless=True, args=["--no-sandbox", "--disable-blink-features=AutomationControlled", "--disable-dev-shm-usage"] ) context = await browser.new_context( viewport={"width": 1920, "height": 1080}, user_agent="Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 ..." ) page = await context.new_page() await Stealth().apply_stealth_async(page) await page.goto(target_url) # Enter username await page.fill('input[name="identifier"]', USERNAME) await page.click('button[type="submit"]') # Enter password await page.wait_for_selector('input[type="password"]') await page.fill('input[type="password"]', PASSWORD) await page.click('button[type="submit"]') # Wait for redirect await page.wait_for_url(f"{target_url}/**", timeout=30000) # Save session await context.storage_state(path=cookies_path.replace('.json', '_state.json')) await browser.close() ``` The saved state is subsequently reused as follows: ```python context = await browser.new_context( storage_state="/tmp/church_cookies_state.json", viewport={"width": 1920, "height": 1080}, user_agent="Mozilla/5.0 ..." ) ``` ### Technical Analysis The Skill writes Playwright storage state to the fixed and predictable path `/tmp/church_cookies_state.json`. Playwright storage-state files can contain cookies and other authentication material sufficient to reuse an authenticated session. The example does not securely create the file, enforce restrictive pe ...[truncated 2184 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Do not persist authentication state unless session reuse is explicitly required. - Store state in a user-private directory rather than a shared `/tmp` path. - Create a fresh, unpredictable temporary directory using a secure operating-system API. - Ensure directories are accessible only to the current user and state files use permission mode `0600`. - Use atomic, no-follow file operations where available, reject symbolic links, and verify ownership before reading existing state. - Prefer an operating-system credential store or another protected secret-storage facility for long-lived tokens. - Encrypt persisted state where appropriate, with the encryption key stored separately. - Delete the state file immediately after its required lifetime and invalidate the server-side session when work is complete. - Avoid logging the state contents or including them in backups and artifacts. - Require reauthentication for high-impact operations instead of indefinitely reusing session state. ]]>

other

Warning

• Location: SKILL.md:32
• Finding: Deliberate Evasion of Service Anti-Automation Detection<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 32-42 **Additional References**: `SKILL.md`, lines 19, 67-68, and 96 **Vulnerability Type**: other: Anti-automation detection evasion **Risk Level**: Medium ### Vulnerable Code ```python browser = await p.chromium.launch( headless=True, args=["--no-sandbox", "--disable-blink-features=AutomationControlled", "--disable-dev-shm-usage"] ) context = await browser.new_context( viewport={"width": 1920, "height": 1080}, user_agent="Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 ..." ) page = await context.new_page() await Stealth().apply_stealth_async(page) ``` The surrounding instructions explicitly describe the intended evasion: ```text No MFA or CAPTCHA is typically required. Playwright + playwright-stealth handles it cleanly. ``` ```python await Stealth().apply_stealth_async(page) ``` ```text Headless Chrome with playwright-stealth avoids detection ``` ### Technical Analysis The Skill does not merely automate a browser; it explicitly suppresses automation indicators with `--disable-blink-features=AutomationControlled`, modifies browser-identifying behavior through `playwright-stealth`, and states that these measures are intended to avoid detection. These controls can impair a service provider's ability to identify automated traffic, enforce anti-abuse protections, or distinguish ordinary interactive account use from machine-driven activity. The concern is amplified because the documented targets include sensitive membership, welfare, financial, donation, and temple-related services. No credential theft, data exfiltration, bulk scraping implementation, or unauthorized account acquisition is present in the reviewed file. The risk arises from providing detection-evasion mechanisms that could facilitate abusive or unauthorized automation when supplied with account credentials. ### Attack Path 1. An operator obtains valid account credentials, whether authorized or un ...[truncated 1220 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Remove `playwright-stealth` and `--disable-blink-features=AutomationControlled`. - Do not describe bypassing detection, CAPTCHA, MFA, or anti-bot controls as a feature. - Prefer officially supported APIs or approved integration mechanisms. - Confirm that automation complies with the service's terms, access policies, and organizational authorization requirements. - Require explicit user authorization before accessing sensitive account sections. - Add operation-level allowlists, conservative rate limits, audit logs, and human confirmation for record modifications or high-impact actions. - Stop and request user intervention if MFA, CAPTCHA, reauthentication, or another security challenge is presented. - Apply least privilege by limiting each run to the specific service and operation requested. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Missing User Warnings

High

• Confidence: 95% confidence
• Finding: The skill handles credentials, session persistence, and access to highly sensitive church account areas, including membership, finance, and temple-related data, but it provides no upfront warning, consent flow, or privacy guardrails. It even recommends storing reusable auth state under `/tmp`, which can expose tokens if the host is shared or compromised, making the overall context especially sensitive and high impact.

Vague Triggers

Medium

• Confidence: 91% confidence
• Finding: The manifest description says to use the skill for logging in, roster lookups, managing callings, viewing temple recommend status, directory access, and 'any other LCR/church website automation,' which is excessively broad. That breadth can cause the skill to activate for many sensitive tasks without clear limits, increasing the chance of over-collection, unintended account actions, or use in contexts the user did not explicitly authorize.

Vague Triggers

Medium

• Confidence: 85% confidence
• Finding: The top-level description 'Automate login and tasks on churchofjesuschrist.org' is too general for a high-sensitivity domain. In context, the site includes protected account, directory, finance, and temple workflows, so vague activation language makes accidental or overly broad use more dangerous than it would be for a low-risk website.

Context-Inappropriate Capability

Medium

• Confidence: 93% confidence
• Finding: The skill explicitly recommends `playwright-stealth` and states it 'avoids detection,' which introduces anti-detection tradecraft unrelated to ordinary account automation. In a skill that automates access to sensitive church systems and member data, normalizing stealth features increases the chance of policy evasion, abuse, and covert access.

Context-Inappropriate Capability

Medium

• Confidence: 97% confidence
• Finding: The sample code disables browser automation signals using `--disable-blink-features=AutomationControlled` and applies stealth behavior, which is a direct mechanism for concealing automation from the target service. Because this skill targets authenticated church resources containing sensitive membership, finance, and temple-related information, such concealment materially raises misuse risk.

Static analysis

No suspicious patterns detected.