Security audit

Strykr Qa Bot

Security checks for vulnerabilities and agentic risk

Overview

This QA skill appears purpose-aligned, but it should be reviewed because it runs an unpinned external npm tool and has under-scoped network and reporting behavior for a financial app.

Review before installing or using in CI. Prefer pinning web-qa-bot to an exact reviewed version, committing a lockfile, and running a local locked binary instead of floating npx commands. Use test accounts, avoid production sessions or secrets, restrict network access to intended Strykr hosts, and treat screenshots, console logs, and reports as potentially sensitive.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (3)

T08 · Insecure Dependencies

Warning

Location: package.json:9
Finding: Mutable Third-Party Package Execution Through npx
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: src/assertions.ts:200
Finding: Unrestricted Network Requests Through Configurable Health Checks
Content: View full analysis
> { const results = new Map(); for (const endpoint of endpoints) { const url = `${baseUrl}${endpoint.endpoint}`; const timeout = endpoint.timeout || 10000; try { const controller = new AbortController(); const timeoutId = setTimeout(() => controller.abort(), timeout); const response = await fetch(url, { method: endpoint.method, signal: controller.signal, headers: { 'Accept': 'application/json' } }); clearTimeout(timeoutId); const isHealthy = response.status === endpoint.expectedStatus; results.set(endpoint.endpoint, isHealthy); if (!isHealthy) { console.warn( `PRISM endpoint unhealthy: ${endpoint.endpoint} ` + `(expected ${endpoint.expectedStatus}, got ${response.status})` ); } } catch (error) { results.set(endpoint.endpoint, false); console.error(`PRISM endpoint error: ${endpoint.endpoint}`, error); } } return results; } ``` The public class accepts caller-controlled values and passes them directly to the request function: ```typescript constructor(config: StrykrConfig) { this.config = { baseUrl: config.baseUrl || 'https://app.strykr.ai', browser: { headless: config.browser?.headless ?? false, timeout: config.browser?.timeout ?? 30000, screenshotDir: config.browser?.screenshotDir ?? './screenshots', consoleCapture: config.browser?.consoleCapture ?? true, ...config.browser }, prismEndpoints: con ...[truncated 3100 chars]
Remediation: View remediation

other

Note

Location: src/strykr-bot.ts:69
Finding: Placeholder QA Assertions Can Produce False Successful Results
Content: View full analysis
{ console.log(`Running suite: ${suitePath}`); // In real implementation, this would: // 1. Load the YAML suite // 2. Initialize browser via web-qa-bot // 3. Execute each test // 4. Capture screenshots // 5. Return results const result: SuiteResult = { name: suitePath, tests: [], passed: 0, failed: 0, skipped: 0, knownIssues: 0, duration: 0 }; this.results.push(result); return result; } ``` Signal-card checks are commented out, leaving no condition that adds an error: ```typescript export function expectSignalCard(options: SignalCardOptions): boolean { const errors: string[] = []; // In browser context, this would query the DOM // For now, we define the validation logic if (options.hasSymbol) { // Check for symbol element // const symbol = document.querySelector('.signal-card .symbol, [data-testid="signal-symbol"]'); // if (!symbol) errors.push('Signal card missing symbol'); } if (options.symbol) { // Verify specific symbol // const symbolText = document.querySelector('.signal-card .symbol')?.textContent; // if (symbolText !== options.symbol) errors.push(`Expected symbol ${options.symbol}, got ${symbolText}`); } if (options.hasPrice) { // Check for price element // const price = document.querySelector('.signal-card .price, [data-testid="signal-price"]'); // if (!price) errors.push('Signal card missing price'); } if (options.hasChart) { // Check for sparkline/chart element // const chart = document.querySelector('.signa ...[truncated 3068 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (16)

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The README promotes screenshot capture and report generation for a live trading platform but does not warn that artifacts may contain sensitive information such as account data, portfolio details, prompts, API error payloads, or session-linked content. In QA and CI contexts, these artifacts are commonly stored, shared, or uploaded, which can lead to inadvertent data exposure even without a software exploit. The skill context makes this more dangerous because the target is a financial application and the reports explicitly include screenshots and console errors.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 92% confidence
Finding: The README instructs users to execute npx web-qa-bot without pinning an exact package version. npx can fetch the latest published package at runtime, so a compromised upstream release or typosquatted replacement could lead to arbitrary code execution on the tester's machine or CI runner. In a QA/CI skill, this is more dangerous because users are explicitly encouraged to run it in automation environments that often have network access, source code, and secrets.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 92% confidence
Finding: This command again relies on unpinned npx web-qa-bot, which permits execution of whatever version is current in the registry when the command is run. That creates a supply-chain risk where malicious or unexpected package changes could execute code during local testing or CI/CD workflows. Because the skill markets itself as CI/CD-ready, the operational context increases the likelihood and impact of abuse.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 90% confidence
Finding: The report-generation example also uses unpinned npx web-qa-bot, exposing users to the same runtime package-fetch and supply-chain execution risk. Even though this command appears lower risk than running tests, it still executes package code that may access local files, results, tokens, or CI workspace contents. The README context makes this a true issue because it is a direct operational instruction to execute external code.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 89% confidence
Finding: The skill describes network-capable behavior against external endpoints like https://app.strykr.ai and PRISM APIs, but it does not declare any explicit tool scope such as permissions or allowed-tools. That creates an authorization and review gap: an agent may infer it should use unrestricted network access, making the skill harder to sandbox and increasing the chance of unintended requests, data exposure, or misuse in broader environments.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 96% confidence
Finding: The npm scripts invoke npx web-qa-bot without an exact version, so execution may fetch whatever version is current or otherwise resolvable in the environment. In a CI/CD-oriented QA skill, that creates a supply-chain risk where tests run arbitrary updated code, potentially leading to code execution or unexpected behavior during automated workflows.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 96% confidence
Finding: This script uses npx web-qa-bot without version pinning, which allows the resolved package version to drift over time or be fetched dynamically. Because the package is used to drive browser-based QA automation, any compromised or breaking upstream release could execute in developer or CI environments.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 96% confidence
Finding: Invoking npx web-qa-bot without a fixed version means this test command may execute unreviewed upstream code when run. In a package marketed as CI/CD-ready, that increases exposure because automated systems may repeatedly execute the command with elevated repository or environment access.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 96% confidence
Finding: The unpinned npx web-qa-bot invocation introduces supply-chain uncertainty because npx can resolve a newer package version than the one originally tested. That is risky for automation tooling, where compromise or malicious takeover of the package could lead to arbitrary command execution on developer workstations or CI runners.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 96% confidence
Finding: This script depends on npx web-qa-bot without locking the package version, creating a path for accidental or malicious upstream changes to affect execution. Since the skill targets trading-platform QA, the context raises concern because automated tests may have access to authenticated sessions, test credentials, or internal environments.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 96% confidence
Finding: Calling npx web-qa-bot here without version pinning allows the actual code run by the script to change independently of this repository. That weakens reproducibility and opens a supply-chain execution risk, particularly in environments that automatically run package scripts.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 96% confidence
Finding: The npx web-qa-bot usage is unpinned, so the script may execute a different package version over time or across environments. For a prebuilt AI-powered QA package, that means an upstream package compromise could directly impact systems running these tests.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 96% confidence
Finding: The smoke test uses npx web-qa-bot without an explicit version, introducing the same supply-chain and reproducibility risk as the other scripts. Because smoke tests are likely to be run frequently against live endpoints, a malicious upstream package could abuse that trusted execution path.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: expectPageNotBlank is documented as validating that a page loaded correctly, but it always returns true and performs no real checks. In a QA/testing skill for a trading platform, this can silently mask blank-page, render-failure, or app-crash conditions, causing automated tests to pass when the UI is actually unusable.
Content: No source excerpt is available for this finding.

Unpinned Dependencies

Low

Category: Supply Chain
Confidence: 40% confidence
Finding: Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.
Content: Scanner excerpt · package.json (reported line 53)May include surrounding context.
json
"author": "Next Frontier", "license": "MIT", "peerDependencies": { "web-qa-bot": "^0.1.0" }, "devDependencies": { "typescript": "^5.3.0"

Unpinned Dependencies

Low

Category: Supply Chain
Confidence: 40% confidence
Finding: Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.
Content: Scanner excerpt · package.json (reported line 56)May include surrounding context.
json
"web-qa-bot": "^0.1.0" }, "devDependencies": { "typescript": "^5.3.0" }, "repository": { "type": "git",

Static analysis

No suspicious patterns detected.