Brand DNA Extractor

• Outcome: Review
• Latest audit: Sep 11, 2026 · 7:25 AM UTC
• Version: 1.0.0

Overview

The skill’s website scraping and AI brand analysis are mostly disclosed, but it recommends exposing a broad Supabase service-role key and lacks tight privacy scoping for externally processed website content.

Install only in an isolated environment with pinned dependencies. Use the skill only on public or authorized sites, assume representative images may be sent to Gemini or OpenAI, and avoid providing a Supabase service-role key; prefer storage disabled or a narrowly scoped cache-only credential/RPC.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:256
• Finding: Unpinned Third-Party Packages and Browser Executable<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 256-258 **Vulnerability Type**: Uncontrolled third-party dependency installation **Risk Level**: Medium ### Vulnerable Code ```bash pip install aiohttp Pillow numpy scikit-learn openai google-generativeai # Optional for JS-heavy sites: pip install playwright && playwright install chromium ``` A related installation instruction also appears at line 84: ```text - Optional dependency: `pip install playwright && playwright install` ``` ### Technical Analysis The installation commands do not pin dependency versions, require package hashes, use a reviewed lockfile, or constrain the package source. Consequently, the exact code installed can change without any modification to the audited Skill. The `playwright install chromium` command additionally retrieves a browser executable from an external distribution channel. Neither the browser revision nor an integrity value is documented in the project. Although no malicious dependency was identified in the supplied artifact, these instructions create an avoidable supply-chain exposure because future or compromised upstream artifacts would be trusted implicitly. The project contains only `SKILL.md`; therefore, there is no dependency manifest, constraints file, lockfile, or vendored implementation with which to verify the installed dependency graph. ### Attack Path 1. An attacker compromises an upstream package release, package-distribution account, package index, browser download channel, or another transitive dependency. 2. Alternatively, a future upstream version introduces malicious behavior or a security regression. 3. A user follows the documented installation commands without version or hash verification. 4. `pip` resolves and installs the currently available releases and their transitive dependencies; Playwright retrieves an external Chromium payload. 5. Installation-time or runtime code executes with the privileges of the user or servic ...[truncated 851 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Add a reviewed dependency manifest and lockfile containing exact versions for every direct and transitive dependency. 2. Use hashes for Python packages, such as a requirements file compatible with `pip install --require-hashes`. 3. Pin Playwright to an approved version and document the corresponding browser revision. 4. Verify browser artifacts through supported integrity controls and retrieve them only from trusted, authenticated sources. 5. Use a controlled internal package mirror or explicitly configured trusted index where practical. 6. Integrate dependency vulnerability and provenance scanning into release review. 7. Run installation and extraction in an isolated, unprivileged environment with minimal filesystem and network access. 8. Avoid exposing credentials to installation steps. Provide secrets only to the runtime components that require them. ]]>

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: SKILL.md:14
• Finding: Overprivileged Supabase Service-Role Credential Recommended for Caching<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 14-17 **Vulnerability Type**: Violation of least privilege through use of a service-role credential **Risk Level**: Medium ### Vulnerable Code ```bash export OPENAI_API_KEY="your_openai_key" # for VLM visual analysis (fallback) export GOOGLE_GENAI_API_KEY="your_gemini_key" # for VLM visual analysis (primary) export SUPABASE_URL="your_supabase_url" # optional: for caching results export SUPABASE_KEY="your_supabase_key" # optional: service role key ``` ### Technical Analysis The documentation recommends making a Supabase service-role key available to the Skill for an optional caching operation. A service-role credential is substantially more privileged than a narrowly scoped credential intended only to create and retrieve cached brand profiles. In ordinary Supabase deployments, service-role access is trusted backend access and can bypass Row Level Security controls. The project does not include implementation code, database policies, credential-isolation controls, or table-scoped authorization logic. It is therefore impossible to verify that the credential is only used for caching or that it cannot be read by dependencies and other runtime components. Environment variables avoid directly hardcoding a real secret in the document, but they do not make an overprivileged credential safe. Every library or subprocess running in the same environment may potentially access it. ### Attack Path 1. An operator follows the documentation and supplies a Supabase service-role key to the Skill runtime. 2. The credential becomes available in the process environment. 3. A compromised dependency, vulnerable future implementation, malicious subprocess, debug output, crash report, or environment disclosure obtains the key. 4. The attacker uses the service-role credential directly against the configured Supabase project. 5. Subject to the project permissions and exposed APIs, ...[truncated 1133 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Do not recommend a general Supabase service-role key for routine caching. 2. Create a dedicated backend identity restricted to the specific cache table and required operations. 3. Permit only the minimum necessary actions, such as selected `SELECT`, `INSERT`, and `UPDATE` operations; deny access to unrelated schemas and tables. 4. Prefer a narrowly scoped server-side API or security-definer RPC that validates inputs and exposes only required cache operations. 5. Configure and test Row Level Security and tenant isolation where applicable. 6. Store credentials in an approved secret manager rather than persistent shell profiles, source files, logs, or example configuration committed to version control. 7. Inject the credential only into the component that performs storage operations; do not expose it during dependency installation or to unrelated subprocesses. 8. Rotate credentials regularly and immediately after suspected disclosure. Monitor backend audit logs for unexpected service-role activity. 9. Document the exact required permissions so operators can verify least-privilege deployment. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The top-level skill description does not clearly warn that the skill will scrape arbitrary websites, optionally crawl subpages, and transmit extracted images/content to external AI providers and optional Supabase storage. This can mislead users into providing URLs containing sensitive, internal, or legally restricted content, creating privacy, confidentiality, and compliance risks through unexpected data egress.