Security audit

Marktplaats

Security checks across malware telemetry and agentic risk

Overview

The skill matches its Marktplaats selling purpose, but some helpers can use browser-session or supplied credentials against URLs that are not limited to Marktplaats.

Review before installing. Use it only for a Marktplaats account and URLs you control, avoid passing raw cookies or custom auth headers, and verify every publish/edit action yourself. The skill does not show evidence of theft or destructive behavior, but its credentialed browser and unrestricted URL helpers deserve careful scoping.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (5)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 87% confidence
Finding: The skill explicitly instructs use of shell commands and browser/network-based workflows, but the metadata declares no permissions beyond requiring Node. That mismatch can bypass least-privilege review and cause an agent runtime to grant or attempt capabilities that were not transparently declared, increasing the risk of unintended command execution, filesystem access, and authenticated web interaction. In this context the danger is elevated because the skill operates on live marketplace listings and local files, so undeclared shell/network use can affect user data and external accounts.

Description-Behavior Mismatch

Medium

Confidence: 97% confidence
Finding: getListingDetails accepts any string starting with "http" and fetches it directly, allowing callers to trigger arbitrary outbound requests instead of being restricted to Marktplaats listing paths. In an agent/tool context, this creates an SSRF-style primitive and expands the skill beyond its intended marketplace scope, potentially enabling access to internal services, cloud metadata endpoints, or other sensitive network resources reachable by the runtime.

Context-Inappropriate Capability

High

Confidence: 99% confidence
Finding: The arbitrary remote fetch is unjustified for a Marktplaats publisher skill and materially increases risk because the function will retrieve attacker-controlled URLs with no origin validation. In a hosted agent environment, this can be abused for SSRF, network probing, retrieval of sensitive internal resources, or use of the agent as a blind proxy to external targets.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: In curl mode, the script accepts arbitrary cookies and headers from the command line or a cookie file and uses them to make authenticated requests, but it provides no user-facing disclosure or friction before doing so. In the context of a publishing/probing skill for Marktplaats, this can silently replay a user's authenticated session or other sensitive headers to remote endpoints, increasing the risk of unintended account actions, data exposure, or misuse if the URL/headers are influenced by another component.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The Safari browser-fetch path performs a same-origin XMLHttpRequest with withCredentials enabled, meaning it reuses the logged-in browser session to fetch authenticated content without any explicit warning to the user. Because this skill is designed to inspect live Marktplaats placement pages, the capability is operationally useful but also more dangerous: it can access account-scoped pages and sensitive form state through the user's existing session, which could be abused by a higher-level agent or unexpected input.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.