Security audit

HarnessFE

Security checks for vulnerabilities and agentic risk

Overview

This frontend debugging skill is coherent, but it needs review because it can inspect and retain sensitive browser activity and runs unpinned packages through the package registry.

Install only if you are comfortable giving the Harness-FE daemon access to sensitive frontend debugging telemetry. Prefer using it on local or test data, pin package versions, avoid production secrets in recorded sessions, clear ~/.harness/ when done, and ask the agent before it inspects recordings, cookies/storage, full network bodies, visitor timelines, or attachments.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

Location: SKILL.md:30
Finding: Unpinned Third-Party Packages Are Installed and Executed
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.md:281
Finding: Frontend Recordings May Retain Unmasked Sensitive Form Data
Content: View full analysis
`. Don't paste recording slices into untrusted contexts — they may contain tokens, addresses, etc. | ``` ### Technical Analysis The Skill explicitly states that rrweb masks only password input fields. Values entered into ordinary text fields, text areas, and other recorded page elements may therefore be captured even when they contain authentication tokens, addresses, personal information, or other confidential data. Captured information is retained in `~/.harness/` until the stated automatic purge occurs. A one-hour purge interval reduces long-term retention but does not protect the data during that interval. The instructions warn users not to paste recordings into untrusted contexts, but advisory handling guidance does not provide technical prevention, comprehensive redaction, access control, or consent enforcement. Session recording is relevant to the declared debugging functionality, but capturing every non-password field exceeds minimum necessity for many debugging tasks. The reviewed file does not show intentional transmission of this telemetry to an external service; the confirmed exposure is local retention and possible disclosure through subsequent tool output or manual sharing. ### Attack Path 1. A user enters confidential information into a field that is not declared as ``. 2. rrweb captures the field value as part of the frontend debugging session. 3. The Harness-FE daemon retains the recording under `~/.harness/`. 4. Another local principal with sufficient filesystem access, a compromised pro ...[truncated 882 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (3)

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The invocation language is broad enough that the skill may activate for generic frontend questions, not just explicit debugging tasks requiring this powerful telemetry bridge. That increases the chance the agent will unnecessarily reach for tools that can inspect live DOM, network, storage, visitor journeys, and recordings, expanding exposure of sensitive data beyond the minimum needed for the user's request.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill advertises capabilities to inspect network traffic, rrweb recordings, storage mutations, and visitor identity/journey data before presenting a prominent upfront privacy warning or consent gate. In context, these tools can reveal tokens, personal data, browsing behavior, and cross-tab/session activity, so omission of an early warning makes inadvertent over-collection or inappropriate inspection more likely.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 93% confidence
Finding: The skill instructs use of npx @harness-fe/mcp-server without pinning an exact version, which allows whatever package version is current at execution time to be fetched and run. Because this is an MCP server with access to browser state, recordings, storage, network traffic, and page evaluation, a compromised or malicious upstream release could execute with broad debugging visibility and tool-mediated access.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.