T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/screenshot.js:21- Finding
Unrestricted Browser Access to Internal and Link-Local Network Resources
- Content
View full analysis
- Remediation
View remediation
Security audit
Screenshot Visual
Security checks for vulnerabilities and agentic risk
Overview
This web reconnaissance screenshot skill has a real security-testing purpose, but it automatically probes sensitive paths and stores captured page data without strong scoping or opt-in controls.
Install only if you intend to run authorized web reconnaissance and are comfortable with it probing common admin/debug/config paths automatically. Use it only on targets you control or are explicitly permitted to test, avoid internal or sensitive network targets unless that is intended, and treat the generated screenshots and JSON reports as potentially sensitive local evidence that may need protection or deletion.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)
T08 · Insecure Dependencies
Note
- Location
SKILL.md:8- Finding
Unpinned and Inconsistent Playwright Dependency Installation
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Findings (8)
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md node scripts/screenshot.js https://example.com
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 97% confidence
- Finding
Including '/.env' in the probe list specifically targets a well-known location that can expose application secrets, API keys, database credentials, and other confidential configuration if misconfigured. In the context of a screenshot tool, this is especially dangerous because it turns the skill into credential-oriented reconnaissance rather than simple visual capture.
- Content
js '/debug', '/phpmyadmin', '/wp-admin', '/.env', '/config', '/swagger', '/swagger-ui',
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
The example trigger phrase
Check login pages for issuesis broad and generic enough that it could match common user requests outside a clearly bounded security-testing context. Overly broad activation phrases can cause unintended invocation of a skill that performs network reconnaissance and screenshot capture, potentially leading to accidental scanning or collection against targets the user did not explicitly scope. The recon-focused context makes this somewhat more dangerous than a generic utility skill because the actions involve external browsing and artifact collection.- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 86% confidence
- Finding
The skill instructs users to run
npx playwright install chromium, which resolves and executes tooling without pinning an explicit version. This creates a supply-chain risk: a compromised or unexpectedly changed upstream package/version could execute unreviewed code in the user's environment during installation. In a security-oriented skill, this is more concerning because users may run the setup on analyst workstations with elevated trust and broad network access.- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill claims to take screenshots of a target, but it also performs multi-endpoint probing and collects security-relevant metadata across common sensitive paths. This expands behavior beyond the stated purpose, creating undisclosed active scanning that can surprise users, trigger alerts, or be misused for reconnaissance.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The hardcoded path list includes administrative and sensitive endpoints such as /admin, /phpmyadmin, /wp-admin, /.env, and /debug that are commonly used for reconnaissance. Probing these locations is riskier than ordinary screenshot capture because it actively searches for exposed management surfaces and sensitive files.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The code actively requests multiple potentially sensitive paths on the target without an explicit warning that it will perform scanning behavior beyond visiting the provided URL. This can cause unauthorized or unexpected interactions with target systems and may violate user expectations or organizational policies.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The script stores screenshots, page text snippets, headers, form details, and interesting links to disk, which may capture credentials, tokens, internal URLs, or other sensitive information. Persisting this data without prominent notice, minimization, or protection increases the chance of inadvertent data exposure on the operator's system.
- Content