AgentEpstein

• Outcome: Review
• Latest audit: Oct 2, 2026 · 10:31 PM UTC
• Version: 1.0.3

Overview

The skill mainly does what it says, but it also automates logged-in browser sessions and can upload scraped image datasets to external services, so it needs careful review before use.

Install only if you are comfortable with an agent scraping art sites, using persistent browser sessions, storing datasets locally, and optionally uploading images to ChatGPT/OpenAI or Hugging Face. Use dry-run/local modes first, avoid attaching everyday browser profiles, review exactly which files will upload, and confirm rights and site terms before publishing or enabling any training-eligible upload path.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain

Findings (55)

Tainted flow: 'req' from os.environ.get (line 96, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 90% confidence

Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/vision_filter.py (reported line 87)May include surrounding context.

python

headers={"Authorization": f"Bearer {key}",
                 "Content-Type": "application/json"},
    )
    with urllib.request.urlopen(req, timeout=120) as r:
        obj = json.loads(r.read().decode())
    return parse_verdict(obj["choices"][0]["message"]["content"])

Tainted flow: 'req' from os.environ.get (line 96, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 90% confidence

Finding

The Ollama backend sends image data to a host taken from the OLLAMA_HOST environment variable with no validation, and the default scheme is plain HTTP. If OLLAMA_HOST is set to a remote or attacker-controlled service, sensitive local image contents will be transmitted off-host, potentially unencrypted and without user awareness.

Content

Scanner excerpt · scripts/vision_filter.py (reported line 101)May include surrounding context.

python

data=json.dumps(body).encode(),
        headers={"Content-Type": "application/json"},
    )
    with urllib.request.urlopen(req, timeout=180) as r:
        obj = json.loads(r.read().decode())
    return parse_verdict(obj.get("response", "{}"))

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · .gitignore (reported line 20)May include surrounding context.

text

.ruff_cache/

# Credentials. Everything comes from the environment, but be explicit.
.env
*.key
*.pem

Anti-Refusal Statement

High

• Category: Anti-Refusal
• Confidence: 80% confidence

Finding

Skill instructs the agent to omit warnings, disclaimers, or ethical commentary. Stripping safety caveats hides risk from the user and is a common jailbreak preamble.

Content

Scanner excerpt · AGENTS.md (reported line 58)May include surrounding context.

md

one session in ways that all *looked* fine from the console. So:

**A claim in this file that the code works is a claim about a specific
version of someone else's UI, and it expires without warning.** If a
reported success is contradicted by the screen, the screen is right.

When a step in this project breaks:

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

The skill claims to harvest art datasets but also includes browser automation to upload local images to ChatGPT/OpenAI using authenticated sessions and persistent profiles. Hidden exfiltration-capable behavior is high risk because harvested or local files can be transmitted to an external service under a user's account even though that is not the declared primary function.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The skill claims to harvest art datasets but also includes browser automation to upload local images to ChatGPT/OpenAI using authenticated sessions and persistent profiles. Hidden exfiltration-capable behavior is high risk because harvested or local files can be transmitted to an external service under a user's account even though that is not the declared primary function.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The skill claims to harvest art datasets but also includes browser automation to upload local images to ChatGPT/OpenAI using authenticated sessions and persistent profiles. Hidden exfiltration-capable behavior is high risk because harvested or local files can be transmitted to an external service under a user's account even though that is not the declared primary function.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

The skill claims to harvest art datasets but also includes browser automation to upload local images to ChatGPT/OpenAI using authenticated sessions and persistent profiles. Hidden exfiltration-capable behavior is high risk because harvested or local files can be transmitted to an external service under a user's account even though that is not the declared primary function.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The skill claims to harvest art datasets but also includes browser automation to upload local images to ChatGPT/OpenAI using authenticated sessions and persistent profiles. Hidden exfiltration-capable behavior is high risk because harvested or local files can be transmitted to an external service under a user's account even though that is not the declared primary function.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The skill claims to harvest art datasets but also includes browser automation to upload local images to ChatGPT/OpenAI using authenticated sessions and persistent profiles. Hidden exfiltration-capable behavior is high risk because harvested or local files can be transmitted to an external service under a user's account even though that is not the declared primary function.

Content

No source excerpt is available for this finding.

Ssd 1

High

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill explicitly frames browser-driven uploads of third-party artwork to ChatGPT as an acceptable workflow while shifting the training/privacy setting decision to the user. That is dangerous because it facilitates transmission of potentially copyrighted or sensitive material to another service and may mislead users into treating account-level consent as sufficient authorization for the content itself.

Content

No source excerpt is available for this finding.

Ssd 3

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The skill directs the agent to persist harvested/user-provided images locally and then upload them through an authenticated browser session to another service. This creates a clear data exfiltration path from local storage to external platforms and amplifies risk because it leverages a user's logged-in account and persistent browser profile.

Content

No source excerpt is available for this finding.

Anti-Refusal Statement

High

• Category: Anti-Refusal
• Confidence: 80% confidence

Finding

Skill instructs the agent to omit warnings, disclaimers, or ethical commentary. Stripping safety caveats hides risk from the user and is a common jailbreak preamble.

Content

Scanner excerpt · SKILL.md (reported line 592)May include surrounding context.

md

### The attachment cap is silent, and the script accounts for it

Verified on a Free account: submitting 4 images produced a message with
**2** in it. No error, no warning, no failed send. The cap is per message,
and what gets dropped is decided server-side after the message is accepted.

So the script does not treat a successful send as success. After each

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

This script adds a capability to exfiltrate harvested image datasets into a third-party service via a logged-in browser session, which is materially different from mere dataset harvesting. In the context of a scraper/collector skill, that creates a direct data-transfer path to an external AI platform and increases legal, privacy, and policy exposure beyond the stated purpose.

Content

No source excerpt is available for this finding.

Ssd 3

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The file is explicitly built to upload a harvested dataset through a user's authenticated ChatGPT session, which is a classic exfiltration channel to an external service. Because the data originates from mass collection/scraping, this materially raises risks of leaking copyrighted, sensitive, or policy-restricted content outside the local collection workflow.

Content

No source excerpt is available for this finding.

Ssd 3

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The code instructs the operator to enable an account-wide setting that makes uploads eligible for model training, increasing downstream dissemination risk beyond simple file transfer. In a scraping/dataset-harvesting context, this is especially dangerous because third-party artwork and metadata may be sent under conditions that allow broader retention and reuse.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The runtime logic actively encourages and automates sending collected images to ChatGPT, a third-party AI service, without that export behavior being inherent to the harvesting purpose. That creates a covertly convenient data-leak path for scraped or copyrighted material and can cause users to transmit data they did not intend to share externally.

Content

No source excerpt is available for this finding.

Ssd 3

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The runtime messaging reinforces that users should configure ChatGPT so uploaded content is eligible for training, which amplifies the impact of external transfer from temporary processing to potential long-term reuse. Given this skill's purpose of harvesting images from third-party art sites, the context makes this significantly more dangerous due to ownership, consent, and provenance concerns.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence

Finding

The skill declares broad operational behavior requiring shell, filesystem, environment, and network access but does not declare any tool scope or allowed-tools boundaries. That omission weakens sandboxing and review because an agent may invoke powerful capabilities implicitly, including network scraping, local writes, environment-variable use, and browser/session operations.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The manifest markets the skill as a harvester, while the body also documents publishing to Hugging Face and uploading images to ChatGPT/OpenAI. In a security context, incomplete disclosure is dangerous because it hides data egress paths and can cause users or policy systems to approve a skill that transmits content externally.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 81% confidence

Finding

The 'When to Use' examples include phrases like 'Harvest images from this artist / this tag on X or Pixiv' and 'That site blocks curl — get the images anyway,' which are fairly broad and overlap with common scraping or downloading requests. The document does not provide explicit trigger constraints or negative examples tied to invocation phrasing, so an agent could over-invoke this skill for general image-fetching tasks.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 89% confidence

Finding

The instruction telling the agent to bootstrap dependencies itself encourages autonomous execution of environment-changing commands without a fresh user checkpoint. In this skill's context, that means creating venvs, installing packages, and possibly browser runtimes, which can have security and supply-chain consequences on the host.

Content

Scanner excerpt · SKILL.md (reported line 239)May include surrounding context.

md

## Prerequisites

**If you are an agent: do this yourself, do not ask the user to.**
Run `scripts/bootstrap.py` first. It is idempotent, it prints the
interpreter path to use, and it needs nothing from the user:

Ssd 4

Medium

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

The workflow normalizes bypassing bot walls and login-gated access, then escalates into account-linked actions and content transfer. In context, this is dangerous because it conditions the agent to treat protected-session access and downstream uploads as routine, increasing the likelihood of misuse, policy violations, or unintended data disclosure.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The skill discusses ChatGPT/OpenAI upload behavior without a strong, explicit privacy warning that harvested or local images will be transmitted to an external provider and may be retained or processed under that provider's policies. That omission materially increases the chance of accidental disclosure of sensitive or copyrighted content.

Content

No source excerpt is available for this finding.

Ssd 1

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The skill instructs the agent to resume work inside a user's authenticated session after relaying login prompts, effectively operationalizing protected-platform access through the user's browser. Even without password capture, this enables automation to act within a live account context, which can be abused for unauthorized scraping, posting, or data access under the user's identity.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.