SeaPortal

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:01 AM UTC
• Version: 0.2.0

Overview

This is a coherent read-only web-fetching skill, but it should be reviewed because it installs a mutable third-party executable and documents credential-bearing proxy usage.

Review the dependency source before installing, prefer pinned or otherwise verified releases, and run the tool with only the filesystem and network access it needs. Avoid putting real proxy passwords directly in command-line URLs when possible, and clean up cache or output directories if fetched pages may contain sensitive or copyrighted content.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:8

Finding

Unpinned External Executable Dependencies

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 8–15
Vulnerability Type: Unpinned third-party executable dependencies
Risk Level: Medium

Vulnerable Code

yaml

install:
  - kind: npm
    package: seaportal
    bins: [seaportal]
  - kind: go
    package: github.com/pinchtab/seaportal/cmd/seaportal@latest
    bins: [seaportal]

Technical Analysis

Both supported installation methods retrieve executable third-party code without selecting an immutable, previously reviewed version. The npm package declaration has no version constraint, while the Go installation path explicitly uses the mutable @latest version.

This creates a supply-chain risk because the code installed in the future may differ from the code intended or reviewed when the Skill was published. If the upstream package, maintainer account, release process, or package registry is compromised, a malicious release could be installed without requiring any modification to this Skill.

The package and repository names are consistent with the declared project homepage. No evidence of dependency confusion, typosquatting, or an actively malicious upstream package was identified in the audited artifact. The vulnerability is therefore the unsafe use of mutable executable dependencies rather than confirmed malicious dependency content.

Attack Path

1. An attacker compromises the upstream npm package, Go repository, maintainer credentials, or release pipeline.
2. The attacker publishes a malicious version as the current release.
3. An Agent installs the dependency using the unversioned npm declaration or the Go @latest reference.
4. The package installation process or subsequently invoked seaportal executable runs attacker-controlled code.
5. The malicious code operates with the permissions and accessible resources of the Agent or user that performed the installation.

Impact Assessment

Successful exploitation coul ...[truncated 611 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the npm dependency to a specific reviewed version rather than resolving the registry's current release.
2. Replace the Go @latest reference with an explicit semantic version, such as @vX.Y.Z, after reviewing that release.
3. Where supported, verify package integrity using lockfiles, cryptographic hashes, signed releases, provenance attestations, or trusted checksums.
4. Execute installation and the resulting CLI under a non-privileged account with access limited to the files and network destinations required for website retrieval.
5. Adopt a controlled dependency-update process in which new versions are scanned, reviewed, tested, and explicitly approved before updating the pinned version.
6. Document the expected publisher, repository, package identity, and verified release digest so substitutions can be detected.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (3)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The skill explicitly documents proxy URLs with embedded user:pass@host credentials, which encourages a usage pattern that can leak secrets via shell history, process listings, logs, or copied command transcripts. In this context, users are likely to paste production proxy credentials directly into CLI commands, making accidental credential exposure plausible even though the tool itself is read-only.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 62% confidence

Finding

The documentation states that the empty default sends a real Chrome UA and presents other preset identities. This natural-language behavior forces a particular client presentation by default rather than requiring the user to opt in, which may conflict with organizational policy around user-controlled client identity or locale-sensitive presentation.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

The skill describes --save-dir and output splitting features that persist fetched page contents to disk, but it does not clearly warn that potentially sensitive or copyrighted remote content will remain on the local filesystem. This creates a modest confidentiality and data-handling risk, especially when agents fetch internal docs, personal data, or regulated content and users assume the tool is transient.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.