Video Proof

• Outcome: Review
• Latest audit: Sep 11, 2026 · 12:53 AM UTC
• Version: 1.0.2

Overview

This skill has a coherent proof-recording purpose, but it runs broad local commands and has exploitable command-injection and privileged setup risks that users should review before installing.

Install only if you are comfortable with a proof tool that can start apps using shell commands, browse pages, send API requests, and write proof artifacts. Run it in a disposable or project-limited environment, review proof specs before execution, avoid untrusted PR-provided specs, and inspect/redact screenshots, videos, console logs, and API results before committing or sharing them. Treat setup.sh as high-impact because it can install mutable dependencies and request sudo.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (4)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/record-proof.js:42

Finding

Shell Command Injection Through Unvalidated start_port

Content

View full analysis

Remediation

View remediation

65535) { throw new Error('start_port must be an integer between 1 and 65535'); } ``` - Eliminate the shell from readiness checks. Prefer Node.js networking APIs such as `http.request`, `fetch`, or `net.connect`. - If `curl` must be used, invoke it with `execFileSync` or `spawnSync` and pass arguments as an array: ```js execFileSync( 'curl', ['-sf', '-o', '/dev/null', `http://localhost:${port}`], { timeout: 5000 } ); ``` - Apply the same correction independently in both `record-proof.js` and `api-proof.js`. - Add regression tests using string, negative, out-of-range, and shell-metacharacter port values. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/record-proof.js:213

Finding

Shell Command Injection Through the Output Directory During Video Conversion

Content

View full analysis

/dev/null`); console.log(`[proof] MP4 converted: ${mp4}`); } catch { console.warn('[proof] ffmpeg not available or conversion failed — .webm still available'); } ``` ### Technical Analysis The `--output` argument controls `outputDir`, which becomes part of both `dest` and `mp4`. These paths are inserted into a command string passed to `execSync`. Wrapping interpolated data in double quotes is not a sufficient shell-escaping mechanism. An output path containing a double quote can terminate the quoted argument, after which shell separators such as semicolons can introduce another command. A malicious output value could conceptually resemble: ```sh --output '/tmp/proof"; touch /tmp/output-pwned; #' ``` When video conversion is reached, the crafted text becomes part of the shell command. Exploitation requires Playwright to have produced a `.webm` file, because conversion only occurs after a recording is found. ### Attack Path 1. An attacker influences a delegated proof command, wrapper script, task instruction, or other source that controls `--output`. 2. The output value contains a quote followed by shell syntax. 3. `record-proof.js` creates the output directory and records a Playwright video. 4. The script locates the `.webm` recording and enters the ffmpeg conversion block. 5. The attacker-controlled path is interpolated into the `execSync` command. 6. The shell parses and executes the ...[truncated 564 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/record-proof.js:146

Finding

Arbitrary File Write Through Screenshot Name Path Traversal

Content

View full analysis

Remediation

View remediation

T08 · Insecure Dependencies

Warning

• Location: scripts/setup.sh:10

Finding

Mutable Dependency Installation and Privileged System Setup

Content

View full analysis

Installing Node dependencies..." cd "$SCRIPT_DIR" if [ ! -f package.json ]; then npm init -y --silent > /dev/null 2>&1 fi npm install --save playwright@latest yaml@latest 2>&1 | tail -3 echo "==> Installing Playwright Chromium..." npx playwright install chromium 2>&1 | tail -3 echo "==> Installing Playwright system dependencies..." npx playwright install-deps chromium 2>&1 | tail -5 ``` The script also attempts privileged system package installation: ```bash if command -v apt-get &> /dev/null; then sudo apt-get update -qq && sudo apt-get install -y -qq ffmpeg elif command -v brew &> /dev/null; then brew install ffmpeg elif command -v dnf &> /dev/null; then sudo dnf install -y ffmpeg elif command -v pacman &> /dev/null; then sudo pacman -S --noconfirm ffmpeg ``` ### Technical Analysis The repository contains a lockfile with reviewed, integrity-pinned dependency versions, but the setup script runs: ```bash npm install --save playwright@latest yaml@latest ``` The `@latest` tags are mutable. Their resolved contents can change after the Skill has been reviewed, and `npm install` can execute package lifecycle behavior unless explicitly disabled. The command also modifies `package.json` and `package-lock.json`, defeating the reproducibility expected from the committed lockfile. The script subsequently invokes Playwright installation commands and package-manager operations. Some system dependency and ffmpeg installation paths use `sudo`, broadening the consequences of a compromised upstream package, registry account, package-manager source, or installation mechanism. No evidence in the audited files demonstrates that the currently locked Playwright or YAML packages are malicious. The finding concerns unsafe dependency reso ...[truncated 1326 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Memory Poisoning: Persistent Context Injection, Context Window Stuffing, Memory Manipulation

Findings (24)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The declared description centers on producing visual proof artifacts such as screen recordings and screenshots after coding tasks. The supplied code instead implements an API verification script: it parses a spec/CLI args, may launch a server process, probes localhost readiness, performs HTTP(S) requests, checks status/body assertions, and saves markdown and JSON summaries. Test logs are partially consistent with the description, but the core promised behavior—video proof and visual demonstration—is absent. Additionally, the code has undeclared operational capabilities such as spawning processes and making network requests to services. This is a material description/behavior mismatch.

Content

No source excerpt is available for this finding.

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 51)May include surrounding context.

md

node scripts/record-proof.js --spec proof-spec.yaml --output ./proof-artifacts

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 57)May include surrounding context.

md

node scripts/record-proof.js --spec proof-spec.yaml --output ./proof-artifacts

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 126)May include surrounding context.

md

For backend/API changes with no UI, use `api-proof.js`:

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 129)May include surrounding context.

md

For backend/API changes with no UI, use `api-proof.js`:

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The script executes a user-supplied start command via sh -c, which gives full shell interpretation and allows arbitrary command execution in the agent or CI environment. Because the skill is supposed to record proof artifacts, this capability is broader than necessary and becomes especially dangerous if the spec or CLI input is attacker-influenced, enabling command chaining, data destruction, secret access, or persistence during proof runs.

Content

No source excerpt is available for this finding.

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 78% confidence

Finding

Chaining sudo apt-get update directly into sudo apt-get install reduces opportunities to inspect repository changes or abort before installation. While common in admin scripts, in an agent-executed skill this pattern increases the blast radius of a single invocation by combining multiple privileged actions into one unattended flow.

Content

Scanner excerpt · scripts/setup.sh (reported line 26)May include surrounding context.

sh

else
  echo "    ffmpeg not found — attempting install..."
  if command -v apt-get &> /dev/null; then
    sudo apt-get update -qq && sudo apt-get install -y -qq ffmpeg
  elif command -v brew &> /dev/null; then
    brew install ffmpeg
  elif command -v dnf &> /dev/null; then

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 89% confidence

Finding

The --noconfirm parameter suppresses package manager confirmation checks, which can be abused to push host-level changes through unattended. In combination with sudo, it materially increases the risk because it removes both user review and privilege boundaries from the final installation step.

Content

Scanner excerpt · scripts/setup.sh (reported line 32)May include surrounding context.

sh

elif command -v dnf &> /dev/null; then
    sudo dnf install -y ffmpeg
  elif command -v pacman &> /dev/null; then
    sudo pacman -S --noconfirm ffmpeg
  else
    echo "    ⚠ Could not install ffmpeg automatically. Install manually for mp4 conversion."
    echo "    Video recording still works (produces .webm without ffmpeg)."

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 94% confidence

Finding

The skill clearly instructs the agent to run shell commands, start local servers, install dependencies, and access localhost or even staging URLs, but it declares no explicit tool scope or permission boundaries. That creates an authorization gap where an agent may execute network and shell actions without clear user-visible constraints, increasing the risk of unintended command execution, data exposure, or misuse of broader agent capabilities.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The trigger phrases include broad natural-language terms like 'show me it working' and 'prove it works,' which can match ordinary conversation and cause the skill to activate unexpectedly. Because the skill can start services, run commands, browse applications, and generate artifacts, accidental invocation could lead to unintended execution, network access, or recording of sensitive application state.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

This skill is designed to capture video, screenshots, and console logs from real applications, but it does not warn that those artifacts may contain secrets, personal data, session tokens, internal URLs, or other sensitive information. In this context, the omission is dangerous because the skill also recommends committing proof artifacts, which could propagate sensitive data into repositories, PRs, or external systems.

Content

No source excerpt is available for this finding.

Context Window Stuffing

Medium

• Category: Memory Poisoning
• Confidence: 85% confidence

Finding

Skill attempts to fill the context window with filler content, displacing legitimate instructions and safety constraints. This can degrade agent performance or bypass safety boundaries.

Content

Scanner excerpt · references/proof-spec.md (reported line 24)May include surrounding context.

md

steps:
    - goto: "/path"                   # Navigate (relative or absolute URL)
    - click: "text=Button"            # Playwright selector
    - fill:                           # Clear + fill input
        selector: "#email"
        value: "[e-mail]"
    - type:                           # Keystroke-by-keystroke input

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The script accepts a user-controlled base URL and performs arbitrary HTTP/HTTPS requests, so it can contact non-local destinations and send attacker-specified paths, headers, and bodies. In a CI or agent environment, this expands the skill from local proof collection into a generic network client, which can be abused for SSRF-style access to internal services or exfiltration of data in responses into generated artifacts.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The script explicitly captures browser video, screenshots, and page console output as artifacts, but it does not provide any consent prompt, warning, masking, or scope restriction for potentially sensitive data shown during the session. In the context of an automation skill intended to run after coding tasks, this can unintentionally collect secrets, personal data, internal URLs, tokens printed to the browser console, or other confidential information and persist them to PR artifacts where they may be more broadly accessible.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 88% confidence

Finding

The script invokes Playwright via npx without pinning the exact CLI/package version at execution time. Even though playwright@latest was installed earlier, npx resolution can still execute an unexpected or newer package version depending on environment state, making the setup non-reproducible and increasing supply-chain risk.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 88% confidence

Finding

This second npx Playwright invocation has the same issue: it does not guarantee execution of a specific trusted version. In a setup script that installs system dependencies, that ambiguity is more sensitive because it can lead to running unintended package code with elevated effects on the host.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 91% confidence

Finding

The script performs sudo apt-get update and install, which modifies the host system with elevated privileges. In an agent skill context, automatic root-level package management is risky because execution may happen in developer environments or CI runners where the script has broad access and can change system state beyond the project boundary.

Content

Scanner excerpt · scripts/setup.sh (reported line 26)May include surrounding context.

sh

else
  echo "    ffmpeg not found — attempting install..."
  if command -v apt-get &> /dev/null; then
    sudo apt-get update -qq && sudo apt-get install -y -qq ffmpeg
  elif command -v brew &> /dev/null; then
    brew install ffmpeg
  elif command -v dnf &> /dev/null; then

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 90% confidence

Finding

This line uses sudo dnf install, again causing privileged modification of the host. The danger is amplified by the skill's purpose as a convenience setup step, which can normalize running elevated commands automatically for multimedia tooling that is not strictly necessary for core functionality.

Content

Scanner excerpt · scripts/setup.sh (reported line 30)May include surrounding context.

sh

elif command -v brew &> /dev/null; then
    brew install ffmpeg
  elif command -v dnf &> /dev/null; then
    sudo dnf install -y ffmpeg
  elif command -v pacman &> /dev/null; then
    sudo pacman -S --noconfirm ffmpeg
  else

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 82% confidence

Finding

Using --noconfirm causes a package installation to proceed without interactive approval, removing an important human verification step. In a setup script that may be run by an agent or automation, this increases the chance of unintended host modification and makes abuse or mistakes easier to carry through silently.

Content

Scanner excerpt · scripts/setup.sh (reported line 32)May include surrounding context.

sh

elif command -v dnf &> /dev/null; then
    sudo dnf install -y ffmpeg
  elif command -v pacman &> /dev/null; then
    sudo pacman -S --noconfirm ffmpeg
  else
    echo "    ⚠ Could not install ffmpeg automatically. Install manually for mp4 conversion."
    echo "    Video recording still works (produces .webm without ffmpeg)."

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 93% confidence

Finding

The sudo pacman invocation runs with root privileges and is fully non-interactive, combining elevation with silent package installation. In a post-coding skill that may be triggered automatically, this presents meaningful risk of unauthorized system changes or abuse if the script or its dependencies are tampered with.

Content

Scanner excerpt · scripts/setup.sh (reported line 32)May include surrounding context.

sh

elif command -v dnf &> /dev/null; then
    sudo dnf install -y ffmpeg
  elif command -v pacman &> /dev/null; then
    sudo pacman -S --noconfirm ffmpeg
  else
    echo "    ⚠ Could not install ffmpeg automatically. Install manually for mp4 conversion."
    echo "    Video recording still works (produces .webm without ffmpeg)."

Known Vulnerable Dependency: yaml==2.8.2 — 1 advisory(ies): CVE-2026-33532 (yaml is vulnerable to Stack Overflow via deeply nested YAML collections)

Low

• Category: Supply Chain
• Confidence: 93% confidence

Finding

The lockfile pins yaml to version 2.8.2, and the reported advisory indicates a denial-of-service condition via stack overflow when parsing deeply nested YAML collections. This is a real dependency risk if the skill processes attacker-controlled or untrusted YAML input, because a crafted file could crash the process or interrupt artifact-generation workflows.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 40% confidence

Finding

Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.

Content

Scanner excerpt · scripts/package.json (reported line 14)May include surrounding context.

json

"license": "ISC",
  "type": "commonjs",
  "dependencies": {
    "playwright": "^1.58.2",
    "yaml": "^2.8.2"
  }
}

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 40% confidence

Finding

Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.

Content

Scanner excerpt · scripts/package.json (reported line 15)May include surrounding context.

json

"type": "commonjs",
  "dependencies": {
    "playwright": "^1.58.2",
    "yaml": "^2.8.2"
  }
}

Known Vulnerable Dependency: yaml==2.8.2 — 1 advisory(ies): CVE-2026-33532 (yaml is vulnerable to Stack Overflow via deeply nested YAML collections)

Low

• Category: Supply Chain
• Confidence: 94% confidence

Finding

The file declares yaml version 2.8.2, which is flagged as vulnerable to stack overflow from deeply nested YAML collections. If this skill parses YAML from untrusted or externally influenced inputs, an attacker could trigger denial of service by causing the Node process to crash or hang during parsing; the automation context makes this somewhat more relevant because agent workflows often ingest config files and repository content.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.dangerous_exec

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: scripts/api-proof.js:55

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: scripts/record-proof.js:45