Security audit

Price Monitor & Daily Excel Report Bot

Security checks for vulnerabilities and agentic risk

Overview

The skill broadly matches its price-monitoring purpose, but it needs review because it browses configured websites with weak browser isolation and emails Excel reports built from untrusted web data.

Review before installing. Use only trusted product URLs, run it in a restricted container or dedicated account, remove --no-sandbox where possible, restrict outbound network access to approved domains, and harden the Excel export against formula injection before emailing reports.

A.I.G

Vulnerability Patterns

Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Error

Location: scripts/run.py:66
Finding: Untrusted Web Content Can Cause Excel Formula Injection
Content: View full analysis
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Warning

Location: scripts/run.py:45
Finding: Unrestricted Browser Navigation with Chromium Sandbox Disabled
Content: View full analysis
dict: """Scrape a single product URL and return price data.""" try: driver.get(url) time.sleep(2) ``` ```python def run_scraper(urls: list) -> pd.DataFrame: """Run Selenium scraper on all URLs.""" opts = Options() opts.add_argument("--headless") opts.add_argument("--no-sandbox") opts.add_argument("--disable-dev-shm-usage") opts.add_argument("--user-agent=Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/120.0.0.0") driver = webdriver.Chrome(options=opts) ``` ### Technical Analysis Values read from `config/urls.txt` are passed directly to Selenium's `driver.get()` without validating the URL scheme, destination hostname, resolved IP address, port, or redirect target. Consequently, anyone able to influence this configuration can direct the browser toward loopback services, private network addresses, link-local addresses, local schemes, or malicious external pages. Because a full browser renders each destination, it may issue secondary requests for scripts, images, frames, and other resources. Blocking only the initial URL would therefore be insufficient unless redirects and subresource access are also controlled at the network level. The code additionally starts Chromium with `--no-sandbox`. This disables an important defense-in-depth boundary intended to limit the consequences of browser-renderer vulnerabilities. Visiting arbitrary or attacker-controlled pages while this protection is disabl ...[truncated 1836 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (7)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The documented purpose understates the skill's effective behavior: it can read secrets, scrape arbitrary URLs, write local data, and send emails, yet these sensitive actions are not reflected in declared permissions or clearly bounded behavior. That mismatch is dangerous because users and enforcement layers may approve the skill for benign reporting while it actually has broader data movement and network capabilities that could be abused for exfiltration or unauthorized automation.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 97% confidence
Finding: The skill advertises capabilities that require environment access, local file access, and outbound network/email behavior, but it declares no explicit tool scope or permissions. This creates a transparency and authorization gap: an agent or reviewer cannot reliably constrain what the skill may access, increasing the risk of unintended secret use, file access, or network exfiltration.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The user-facing description does not prominently warn that the skill stores scraped/raw data and reports on disk and emails reports to configured recipients. This lack of disclosure is risky because users may provide URLs or request a run without understanding that data will persist locally and be transmitted externally, creating privacy, compliance, and data-handling concerns.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The usage examples are broad and resemble ordinary assistant requests, such as checking prices, sending summaries, or adding URLs, without clear trigger boundaries. In an agent environment, that can cause overbroad invocation and unintended execution of scraping, file writes, or email sending when a user did not explicitly consent to those side effects.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The manifest says the bot monitors prices and emails a daily Excel report, so emailing is in scope. However, directly reading secrets from environment variables introduces credential-access capability that is not described in the manifest and is broader than the core price-monitor/report behavior.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 86% confidence
Finding: This code accesses sensitive email credentials via environment variables, but there is no accompanying comment, prompt, or user-facing disclosure explaining that the skill will consume stored SMTP secrets. For code files, sensitive credential access should be disclosed unless already clearly documented elsewhere in the skill materials.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 71% confidence
Finding: The skill emits fixed natural-language email content in English, with no indication that users can choose another language or that English-only output is a documented requirement. The policy requires flagging language constraints when a skill forces a specific language without user opt-in.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.