T09 · Insecure Skill Coding Practices
Error
- Location
scripts/html-to-pdf.js:155- Finding
Chromium Sandbox Disabled While Executing Potentially Untrusted HTML
- Content
View full analysis
- Remediation
View remediation
Security audit
html-to-pdf
Security checks for vulnerabilities and agentic risk
Overview
The skill does convert HTML to PDF, but it runs user HTML in an unsandboxed browser and can contact external services during conversion, so it should be reviewed before installation.
Install only if you are comfortable running a headless browser on the HTML you convert. For untrusted or sensitive documents, run it in an isolated low-privilege environment with network access blocked, avoid the default no-sandbox mode, and use the bundled lockfile with npm ci or otherwise pin and update Puppeteer and its transitive dependencies.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)
T08 · Insecure Dependencies
Warning
- Location
SKILL.md:28- Finding
Installation Instructions Omit the Lockfile and Allow Dependency Drift
- Content
View full analysis
/scripts/html-to-pdf.js ./ cp /scripts/package.json ./ # 2. Install the only dependency (downloads Chromium automatically, ~170 MB, one-time) npm install ``` The dependency uses a version range rather than an exact version: ```json "dependencies": { "puppeteer": "^24.0.0" } ``` The bundled lockfile currently resolves Puppeteer to a specific package that has an installation script: ```json "node_modules/puppeteer": { "version": "24.40.0", "resolved": "https://registry.npmjs.org/puppeteer/-/puppeteer-24.40.0.tgz", "integrity": "sha512-IxQbDq93XHVVLWHrAkFP7F7iHvb9o0mgfsSIMlhHb+JM+JjM1V4v4MNSQfcRWJopx9dsNOr9adYv0U5fm9BJBQ==", "hasInstallScript": true, ``` ### Technical Analysis The repository includes a lockfile with exact package versions and integrity hashes, but the Quickstart instructs users to copy only the script and `package.json`. Running `npm install` without that lockfile causes npm to resolve the caret range `^24.0.0` again. Consequently, a future compatible Puppeteer 24.x release may be installed instead of the version reviewed in this audit. Puppeteer has an installation script and downloads a Chromium executable during installation. Omitting the lockfile therefore weakens reproducibility for both JavaScript dependencies and an executable component used at runtime. It also conflicts with the documentation's assertion that the downloaded Chromium binary is pinned. No malicious dependency or unsafe registry URL was identified in the reviewed lockfile. T ...[truncated 1424 chars]- Remediation
View remediation
/scripts/package.json ./ cp /scripts/package-lock.json ./ npm ci ``` 2. Replace the caret range with the exact reviewed Puppeteer version: ```json "puppeteer": "24.40.0" ``` 3. Use `npm ci` rather than `npm install` so installation fails if the manifest and lockfile disagree. 4. Retain and validate npm integrity hashes in the lockfile. 5. Pin the expected Chromium revision and document its trusted download source. 6. Where feasible, download browser artifacts in a controlled build stage, verify their checksums, and distribute an immutable container image. 7. Run dependency installation as an unprivileged user in an isolated environment without access to production credentials. 8. Add automated dependency and browser vulnerability scanning to the release process. ]]>
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (12)
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
Launching Chromium with --no-sandbox and --disable-setuid-sandbox removes a major containment boundary while rendering potentially attacker-controlled HTML and JavaScript. If a browser exploit or dangerous browser feature is triggered by the input HTML, the lack of sandboxing can significantly increase the chance of host compromise or broader file/system access.
- Content
Known Vulnerable Dependency: basic-ftp==5.2.0 — 4 advisory(ies): GHSA-6v7q-wjvx-w8wg (basic-ftp: Incomplete CRLF Injection Protection Allows Arbitrary FTP Command Exe); CVE-2026-39983 (basic-ftp has FTP Command Injection via CRLF); CVE-2026-41324 (basic-ftp vulnerable to denial of service via unbounded memory consumption in Cl) +1 more
High
- Category
- Supply Chain
- Confidence
- 80% confidence
- Finding
Dependency has known vulnerabilities (CVEs). Using packages with unpatched security flaws exposes the environment to known exploits.
- Content
Known Vulnerable Dependency: extract-zip==2.0.1 — 2 advisory(ies): CVE-2026-19693 (extract-zip allows arbitrary file writes through symlink archive entries); CVE-2026-56876 (extract-zip unvalidated symlink path traversal)
High
- Category
- Supply Chain
- Confidence
- 92% confidence
- Finding
extract-zip is a real transitive dependency used by @puppeteer/browsers during browser download/install, and symlink traversal or arbitrary-write flaws in archive extraction can become dangerous in build or install environments. If an attacker can influence the downloaded browser archive, registry, mirror, or package-install path, they may write files outside the intended directory and potentially achieve code execution or persistence.
- Content
Known Vulnerable Dependency: ip-address==10.1.0 — 2 advisory(ies): CVE-2026-69192 (ip-address: Address4 decodes leading-zero octets as decimal while resolvers deco); CVE-2026-42338 (ip-address has XSS in Address6 HTML-emitting methods)
High
- Category
- Supply Chain
- Confidence
- 80% confidence
- Finding
Dependency has known vulnerabilities (CVEs). Using packages with unpatched security flaws exposes the environment to known exploits.
- Content
Known Vulnerable Dependency: js-yaml==4.1.1 — 4 advisory(ies): CVE-2026-84375 (js-yaml: maxTotalMergeKeys does not limit CPU use for empty merge sources); CVE-2026-59869 (js-yaml: YAML merge-key chains can force quadratic CPU consumption); GHSA-5p4m-2wfm-xmqj (JS-YAML: Quadratic CPU consumption in !!omap resolution (3.x and 4.x) — CVE-2026) +1 more
High
- Category
- Supply Chain
- Confidence
- 84% confidence
- Finding
js-yaml is a real transitive dependency via cosmiconfig, and the reported flaws are CPU-consumption DoS issues triggered by crafted YAML content. If the skill or its runtime loads attacker-controlled configuration files during execution or install-time tooling, an attacker could cause excessive CPU use and service degradation.
- Content
Known Vulnerable Dependency: ws==8.20.0 — 2 advisory(ies): CVE-2026-45736 (ws: Uninitialized memory disclosure); CVE-2026-48779 (ws: Memory exhaustion DoS from tiny fragments and data chunks)
High
- Category
- Supply Chain
- Confidence
- 80% confidence
- Finding
ws is a real runtime dependency of puppeteer-core, and memory disclosure or fragmentation-based memory exhaustion in WebSocket handling can affect browser automation sessions that communicate over the DevTools/WebDriver BiDi channels. While this skill is primarily local HTML-to-PDF conversion, the use of headless Chrome makes unsafe WebSocket behavior more relevant than in a pure offline converter, especially in shared or remotely orchestrated environments.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The trigger guidance includes the broad phrase 'make a PDF of this' with limited exclusion criteria, which can cause the agent to invoke the skill in ambiguous contexts where the source is not clearly HTML. Over-broad routing increases the chance of misapplication, unsafe file handling assumptions, or unintended processing of content that should be handled by a different, more constrained workflow.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 70% confidence
- Finding
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 70% confidence
- Finding
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The script injects a Google Fonts stylesheet into untrusted HTML before rendering, causing headless Chrome to make outbound network requests during conversion. In an HTML-to-PDF skill, this can leak metadata such as conversion timing, IP/environment details, and creates a dependency on external content for rendering, which is especially risky when processing sensitive local documents.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The injected font link causes the renderer to contact an external service without any explicit warning or consent mechanism. In this skill context, users may expect local HTML-to-PDF conversion, so silent network access can expose sensitive document usage patterns and violate privacy or environment assumptions.
- Content
Unpinned Dependencies
Low
- Category
- Supply Chain
- Confidence
- 40% confidence
- Finding
Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.
- Content
json "convert": "node html-to-pdf.js" }, "dependencies": { "puppeteer": "^24.0.0" }, "engines": { "node": ">=18.0.0"
Static analysis
No suspicious patterns detected.