T09 · Insecure Skill Coding Practices
Error
- Location
scripts/html-to-image.js:311- Finding
Untrusted HTML Executes in Chromium with Browser Sandboxing Disabled
- Content
View full analysis
- Remediation
View remediation
Security audit
Mindflow
Security checks for vulnerabilities and agentic risk
Overview
This mind-map skill is not obviously malicious, but it uses an under-disclosed browser rendering step that can execute active HTML with weakened browser isolation.
Install only if you are comfortable running it in an isolated workspace or container with minimal filesystem access and preferably no network access. Avoid feeding it untrusted Markdown or HTML, review generated intermediate HTML before rendering, and pin dependencies before use.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)
T08 · Insecure Dependencies
Warning
- Location
SKILL.md:14- Finding
Runtime Dependencies Are Installed Without Version or Integrity Pinning
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (8)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The declared description says the skill turns text/Markdown/TXT into mind map images. The supplied code does not parse text, Markdown, or TXT, and it does not generate a mind map structure from source text. Instead, it reads an HTML file from disk, loads it in Puppeteer, optionally measures a rendered #mindmap SVG, and screenshots the page to PNG/JPEG. While the implementation is compatible with pre-rendered markmap-style mind map HTML, its actual primary function is HTML-to-image conversion, not text-to-mind-map generation. That is a material description/behavior mismatch.
- Content
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md node (or bun) scripts/html-to-image.js --auto-fit <input-html> <output-image>
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md node (or bun) scripts/html-to-image.js --auto-fit <input-html> <output-image>
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The trigger language is very broad ('whenever text needs to be converted') and could cause the skill to activate on unrelated content. Because the skill reads files, invokes an LLM, and writes outputs, accidental invocation can lead to unintended local file access, processing of sensitive content, or unnecessary execution of external tooling.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The implementation accepts and renders arbitrary HTML files, while the skill description says it converts text, Markdown, or TXT into mind-map images. This mismatch expands the attack surface from passive text processing to active browser rendering of untrusted markup, potentially enabling script execution, external fetches, and browser-based abuse that users and orchestrators would not expect from the declared capability.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The script renders attacker-controlled HTML with Puppeteer via page.setContent, which allows the document to fetch external resources such as images, stylesheets, fonts, or scripts referenced in the HTML. In a skill advertised as converting local text content to a mind-map image, this creates unintended network egress, enabling SSRF-like access from the execution environment, metadata probing, tracking, or leakage through outbound requests.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The skill accepts user-supplied file paths and writes output files, but it does not warn users that local files will be read and new files created. This can surprise users into exposing sensitive local content or leaving generated artifacts in unintended locations, especially in agentic environments with filesystem access.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
This code reads arbitrary HTML, loads it into Puppeteer via page.setContent, and writes a screenshot to the filesystem. While the file header describes the converter's purpose, there is no explicit runtime warning or comment disclosing that rendering untrusted HTML may execute page resources in a browser context and that the tool will create or overwrite an output image file.
- Content
Static analysis
No suspicious patterns detected.