T09 · Insecure Skill Coding Practices
Error
- Location
index.js:24- Finding
OS Command Injection Through the MCP URL Parameter
- Content
View full analysis
- Remediation
View remediation
Security audit
Playwright Scraper
Security checks for vulnerabilities and agentic risk
Overview
This scraper does not show confirmed data theft, but it contains unsafe command execution and overbroad access to a live browser session.
Review carefully before installing. Use only in an isolated environment, do not connect it to your normal logged-in browser, pin and audit dependencies, and replace the shell-based URL handling with safe argument passing and URL validation before exposing the MCP tool.
Vulnerability Patterns
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Findings (3)
T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
goofish_browse.cjs:3- Finding
Overprivileged Attachment to an Existing Authenticated Browser Session
- Content
View full analysis
{ // Connect to the existing Chrome instance through CDP const browser = await chromium.connectOverCDP(CDP_WS_URL); // Obtain every open page const contexts = browser.contexts(); const pages = contexts[0]?.pages() || []; console.log('=== Current tabs ==='); for (const page of pages) { const title = await page.title(); const url = page.url(); console.log(` 📄 ${title.substring(0,50)}`); console.log(` ${url.substring(0,80)}`); } ``` ### Technical Analysis The scripts connect through Chrome DevTools Protocol to an already running browser at a hard-coded localhost WebSocket endpoint. CDP access is highly privileged: it can expose browser contexts, open pages, authenticated sessions, cookies, local storage, page content, and page-control operations. `goofish_browse.cjs` retrieves every page in the first browser context and prints each page's title and URL before identifying the Goofish page. This reveals unrelated browsing activity that is not necessary to scrape Goofish. URLs may contain private resource identifiers, search terms, document paths, OAuth parameters, or tokens. Several other scripts connect to the same browser session and select an existing Goofish page. For example, `goofish_category.cjs:6-11` locates an existing page and navigates it to another URL: ```javascript const pages = browser.contexts()[0]?.pages() || []; let page = pages.find(p => p.url().includes('goofish')); if ...[truncated 1984 chars]- Remediation
View remediation
T08 · Insecure Dependencies
Note
- Location
SKILL.md:14- Finding
Non-Reproducible Installation Through Unpinned npm Commands
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (43)
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
Attaching to a user's existing Chrome instance via a hardcoded localhost CDP endpoint grants the script visibility into the live browser session, including authenticated pages, cookies, and open-tab context. For a scraping skill, this is unjustified and materially increases the risk of privacy invasion and session abuse if the code is reused or modified.
- Content
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
By enumerating existing browser contexts and pages, the code can inspect and act on arbitrary tabs already open in the connected browser session, not just the intended target site. In the context of a scraping skill, this materially broadens capability into cross-site session access and potential interaction with unrelated authenticated pages, making accidental or intentional data exposure much more dangerous.
- Content
Known Vulnerable Dependency: brace-expansion==1.1.12 — 4 advisory(ies): CVE-2026-13149 (brace-expansion: DoS via exponential-time expansion of consecutive non-expanding); CVE-2026-33750 (brace-expansion: Zero-step sequence causes process hang and memory exhaustion); CVE-2026-14257 (brace-expansion: DoS via unbounded expansion length causing an out-of-memory pro) +1 more
High
- Category
- Supply Chain
- Confidence
- 93% confidence
- Finding
brace-expansion 1.1.12 has multiple reported DoS conditions from pathological expansion input. Although it is transitive through older utility packages and may not be directly reachable in normal skill operation, if any attacker-controlled glob/brace patterns reach this library it can cause CPU or memory exhaustion.
- Content
Known Vulnerable Dependency: express-rate-limit==8.2.1 — 1 advisory(ies): CVE-2026-30827 (express-rate-limit: IPv4-mapped IPv6 addresses bypass per-client rate limiting o)
High
- Category
- Supply Chain
- Confidence
- 89% confidence
- Finding
express-rate-limit 8.2.1 is reported vulnerable to bypass using IPv4-mapped IPv6 addresses, which can defeat per-client throttling. In this dependency tree it comes from the MCP SDK, so if the skill runs an exposed SDK-backed HTTP server, rate-limit protections may be weaker than intended and abuse becomes easier.
- Content
Known Vulnerable Dependency: fast-uri==3.1.0 — 7 advisory(ies): CVE-2026-13676 (fast-uri vulnerable to host confusion via failed IDN canonicalization); CVE-2026-18446 (fast-uri vulnerable to host confusion via backslash authority introducer); CVE-2026-75975 (fast-uri vulnerable to server-side request forgery via malformed IPv6 normalizat) +4 more
High
- Category
- Supply Chain
- Confidence
- 80% confidence
- Finding
fast-uri 3.1.0 is flagged for multiple URI parsing issues including host confusion and SSRF-relevant normalization failures. Because it is used by AJV-related schema tooling in the SDK dependency chain, exploitability is context-dependent, but malformed attacker-controlled URIs could be misvalidated or misclassified if these code paths are exercised.
- Content
Known Vulnerable Dependency: hono==4.12.5 — 16 advisory(ies): CVE-2026-56762 (Hono missing validation of cookie name on write path in setCookie()); CVE-2026-47676 (Hono: app.mount() strips mount prefix using undecoded path, causing incorrect ro); CVE-2026-47675 (Hono: Cookie helper does not sanitize sameSite and priority, allowing Set-Cookie) +13 more
High
- Category
- Supply Chain
- Confidence
- 92% confidence
- Finding
hono 4.12.5 carries numerous advisories affecting routing, cookies, static serving, and request handling. Since it is a direct framework dependency of the MCP SDK, any exposed SDK server functionality could inherit these weaknesses, making this a meaningful real vulnerability in the dependency set.
- Content
Known Vulnerable Dependency: ip-address==10.0.1 — 2 advisory(ies): CVE-2026-69192 (ip-address: Address4 decodes leading-zero octets as decimal while resolvers deco); CVE-2026-42338 (ip-address has XSS in Address6 HTML-emitting methods)
High
- Category
- Supply Chain
- Confidence
- 80% confidence
- Finding
ip-address 10.0.1 is flagged for address parsing inconsistencies and an XSS issue in HTML-emitting methods. Here it is pulled in by express-rate-limit, so the parsing flaw is more relevant than the HTML issue: inconsistent canonicalization can undermine IP-based security decisions such as rate limiting or allow/deny logic.
- Content
Known Vulnerable Dependency: path-to-regexp==8.3.0 — 2 advisory(ies): CVE-2026-4923 (path-to-regexp vulnerable to Regular Expression Denial of Service via multiple w); CVE-2026-4926 (path-to-regexp vulnerable to Denial of Service via sequential optional groups)
High
- Category
- Supply Chain
- Confidence
- 87% confidence
- Finding
path-to-regexp 8.3.0 has reported ReDoS issues from crafted route patterns. As a routing dependency used by router/express in the SDK stack, the main risk is service degradation if attacker influence exists over route compilation or matching with pathological patterns.
- Content
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The script connects to a pre-existing Chrome DevTools Protocol endpoint and enumerates existing browser contexts/pages, which can expose unrelated tabs, authenticated sessions, cookies, and page data outside the stated scraping task. In a skill context, this creates an unjustified capability to access a user's broader browser state, making data leakage or unauthorized interaction significantly more dangerous.
- Content
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
Connecting to an already-running local Chrome instance over CDP gives this script access to the user's existing browser context, including active tabs, session cookies, and authenticated state, rather than a clean isolated automation session. For a scraper, this is unnecessary and significantly increases the risk of covert data access, session hijacking, and abuse of the user's logged-in accounts.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The skill explicitly promotes bypassing anti-bot protections using stealth tooling, but does not adequately warn about legal, privacy, and network-transmission risks. In context, this increases the chance that operators will use the skill to access sites in ways that violate terms of service, trigger abuse defenses, or collect data without sufficient authorization controls.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 93% confidence
- Finding
The skill instructs users to run
npx playwrightwithout pinning an explicit version, which can fetch whatever version is current at execution time. This creates a supply-chain and reproducibility risk: a compromised or breaking upstream release could be installed and executed in the user's environment.- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The script connects to an existing local Chrome session over CDP, enumerates all contexts/pages, and prints titles and URLs for every open tab before narrowing to the intended target. That behavior exceeds the stated purpose of scraping a specific site and can expose unrelated browsing activity and sensitive page metadata from the user's active session.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The script reads page content from the matched Goofish page and prints extracted navigation and body-derived lines to the console without any warning, filtering, or confirmation. Console output can leak personal, commercial, or otherwise sensitive page data into logs or terminals, especially when the browser session is already authenticated.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The script attaches to a pre-existing Chrome DevTools Protocol endpoint instead of creating an isolated browser instance. That gives the skill access to the state, cookies, tabs, and authenticated context of whatever browser is already running, which exceeds the stated scraping purpose and can expose sensitive user/session data if reused or manipulated.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The script attaches to an already-running local Chrome DevTools Protocol session via a hard-coded websocket endpoint, which can inherit the user's active browser state, cookies, authenticated sessions, and open tabs without any consent prompt or isolation. In this skill's context, that is more dangerous because the stated purpose is to bypass anti-scraping protections, and the code selectively reuses an existing page matching the target site before navigating and extracting content.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The natural-language description and parameter text are presented only in Chinese, which imposes a specific language/locale without offering user opt-in or documenting a justified region-specific constraint. This can violate language/locale policy when the skill is not explicitly limited to Chinese-speaking users.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The manifest describes a Playwright-based scraping skill, which reasonably implies browser automation and network access, but not arbitrary process execution. Using execSync introduces a broader capability—launching local commands—that exceeds what is semantically necessary for the declared tool purpose.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The tool passes a user-controlled URL into execSync through a shell command string:
node scripts/playwright-stealth.js "${url}". This creates a command injection risk if the URL contains shell metacharacters or quote-breaking input, and the stealth-scraping context makes the capability more dangerous because it already aims to access protected targets and can be abused to run arbitrary local commands.- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The script overrides browser language settings to always report 'zh-CN' and 'zh'. This imposes a specific locale preference without offering the user a choice or documenting a justified region-specific requirement.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The skill performs automated retrieval of a live third-party website and outputs page content without any disclosure, consent check, or scope restriction. In this context, the surrounding anti-detection logic (
--disable-blink-features=AutomationControlled, navigator property spoofing) makes the behavior more concerning because it is clearly designed to evade the target site's bot detection while scraping remote content.- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The manifest describes a broad scraping capability using Playwright and a stealth plugin to bypass anti-scraping protections. In contrast, this file hard-codes navigation to Goofish searches for specific terms ("代写" and "数学建模") and extracts marketplace listings, which is a much narrower and materially different behavior than a general-purpose scraper.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The code explicitly uses anti-detection techniques for scraping, including disabling Blink automation features and redefining navigator.webdriver to evade bot detection. In the context of a skill advertised as bypassing anti-scraping controls, this facilitates circumvention of site defenses and makes abuse more likely even though it does not contain a full stealth plugin.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The browser context is hard-coded to use the zh-CN locale, which imposes a specific language/locale choice without any indication of user selection or documented justification. The policy for natural-language behavior requires offering a language or locale choice, or clearly documenting why a fixed locale is necessary.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The implementation materially differs from the stated generic scraping purpose by hard-coding searches against Goofish for terms including '代写' (ghostwriting). That mismatch is risky because it conceals a more specific collection objective and can enable scraping in support of academic fraud or other policy-violating marketplace activity.
- Content
Static analysis
Detected: suspicious.dangerous_exec
Shell command execution detected (child_process).
Critical
- Code
- suspicious.dangerous_exec
- Location
- index.js:29