Brand Dna Extractor

• Outcome: Review
• Latest audit: Sep 14, 2026 · 11:21 PM UTC
• Version: 1.0.2

Overview

The skill is purpose-aligned for brand analysis, but it asks users to use broad external services and an optional Supabase service-role key without enough scoping or privacy guidance.

Review before installing. Use only on public sites you are allowed to analyze, assume images and derived metadata may be sent to Gemini/OpenAI, keep caching disabled unless needed, and do not use a Supabase service-role key from a production project. Install dependencies in a virtual environment or container.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:257
• Finding: Unpinned Third-Party Dependencies and Browser Artifacts## Vulnerability Details **File Location**: `SKILL.md:85` and `SKILL.md:257-259` **Vulnerability Type**: Uncontrolled third-party dependency resolution **Risk Level**: Medium **Vulnerable code snippets**: ```markdown - Optional dependency: `pip install playwright && playwright install` ``` ```bash pip install aiohttp Pillow numpy scikit-learn openai google-generativeai # Optional for JS-heavy sites: pip install playwright && playwright install chromium ``` ### Technical Analysis The installation instructions resolve Python packages and a Chromium browser artifact without specifying exact versions, package hashes, or a reviewed lockfile. Consequently, the software installed when a user follows these instructions can differ from the components that existed when the Skill was audited. Python packages may execute build hooks during installation and arbitrary code when imported or used. The broad set of dependencies also inherits transitive dependencies that are not identified or constrained by this project. Likewise, `playwright install chromium` retrieves a browser artifact according to the installed Playwright release without documenting or verifying the expected artifact version. No malicious package or malicious remote payload was observed in the supplied project. The vulnerability is the mutable and insufficiently verified dependency supply chain, rather than evidence that the named packages are currently compromised. ### Attack Path 1. An attacker compromises a named package, one of its transitive dependencies, its package-index account, or an artifact distribution channel. 2. The attacker publishes a malicious release that still satisfies the unconstrained installation command. 3. A user follows the documented installation instructions. 4. `pip` or Playwright resolves and downloads the attacker-controlled release or artifact. 5. Malicious code executes during package installation, import, br ...[truncated 844 chars]
• Remediation: ## Remediation Suggestions 1. Publish a reviewed dependency lockfile containing exact direct and transitive versions. 2. Pin every Python dependency to an exact version rather than allowing unconstrained resolution. 3. Generate and verify cryptographic hashes, and install with `pip install --require-hashes`. 4. Configure an explicit trusted package index and prevent unexpected fallback to untrusted or public indexes where appropriate. 5. Pin Playwright and its associated Chromium revision, and document how the browser artifact's integrity is verified. 6. Run installation and extraction in an isolated virtual environment or container under a non-privileged account. 7. Separate dependency installation from processes that hold production secrets. 8. Add automated software-composition analysis and dependency-update review before accepting new releases.

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:18
• Finding: Overprivileged Supabase Service-Role Credential Recommended for Caching## Vulnerability Details **File Location**: `SKILL.md:18` **Vulnerability Type**: Excessive database credential privileges and unsafe secret exposure **Risk Level**: Medium **Vulnerable code snippet**: ```bash export SUPABASE_KEY="your_supabase_key" # optional: service role key ``` ### Technical Analysis The documentation recommends a Supabase service-role key for an optional result-caching feature. Service-role credentials commonly bypass row-level security and can provide broad access to the associated Supabase project. Such authority exceeds the minimum permissions ordinarily required to store and retrieve cached brand profiles. Exporting this credential into the process environment makes it available to the Skill process and any libraries or subprocesses it launches. This concern is amplified by the documented use of numerous third-party packages and browser tooling. The key is a placeholder rather than a hardcoded secret, and no implementation was provided that directly transmits or steals it. The finding concerns the documented request for an excessively privileged production credential and the resulting blast radius if the runtime or a dependency is compromised. ### Attack Path 1. A user follows the instructions and exports a real Supabase service-role key. 2. The extraction process, imported dependencies, and applicable child processes inherit the environment variable. 3. A compromised dependency, malicious browser component, runtime flaw, or unintended diagnostic path reads the key from the environment. 4. The key is transmitted to an attacker or used directly against the Supabase API. 5. Because a service-role key can bypass normal row-level restrictions, the attacker may read, modify, insert, or delete data beyond the cache records legitimately needed by the Skill, subject to the actual permissions of that key. ### Impact Assessment The potential impact includes unauthorized access to data in th ...[truncated 425 chars]
• Remediation: ## Remediation Suggestions 1. Do not recommend a Supabase service-role key for routine caching. 2. Create a dedicated, least-privileged credential limited to the specific cache table and required operations. 3. Enforce row-level security and restrict access by user, tenant, or cache namespace as appropriate. 4. Keep service-role operations in a controlled backend service rather than exposing the key to a general extraction runtime. 5. Store secrets in a dedicated secret manager and inject them only into the component that requires them. 6. Prevent browser processes and unrelated subprocesses from inheriting sensitive environment variables. 7. Document the exact minimum database permissions required and provide key-rotation and revocation procedures. 8. Add secret redaction to logs, exceptions, diagnostics, and telemetry.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The skill explicitly scrapes arbitrary websites, extracts images and metadata, and sends representative images to external VLM providers, with optional caching in Supabase, but it does not clearly warn users that third-party site content and derived metadata may be transmitted off-platform and stored. This creates a real data-handling and privacy risk, especially if users point it at internal, sensitive, or contract-restricted sites under the assumption that analysis is local-only.

Static analysis

No suspicious patterns detected.