Security audit

Agent Dashboard

Security checks for vulnerabilities and agentic risk

Overview

The dashboard skill is purpose-aligned, but its remote tiers need review because they can publish operational data with weak client-side protection and public Supabase read/write access.

Use Tier 1 or add real server-side authentication before publishing anything sensitive. Do not rely on the embedded PIN for confidentiality, avoid internal URLs, secrets, private error text, or personal data in dashboard fields, and tighten Supabase policies before using Tier 3. Review any cron update carefully because it can keep publishing agent and cron status on a schedule.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (4)

T09 · Insecure Skill Coding Practices

Error

Location: assets/templates/setup-supabase.sql:26
Finding: Client-side PIN does not enforce access control over dashboard data
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: assets/templates/setup-supabase.sql:31
Finding: Anonymous database writes can produce dashboard tampering and stored cross-site scripting
Content: View full analysis
`

${item.priority} ${escapeHtml(item.title)}
${item.url ? `Open →` : ''}
`).join(''); ``` ```javascript productsGrid.innerHTML = data.products.map(product => `
${escapeHtml(product.name)}

${product.status.charAt(0).toUpperCase() + product.status.slice(1)}

Checked ${formatTime(product.lastChecked)}
`).join(''); ``` Realtime updates are rendered automatically: ```javascript channel = sbClient .channel('dashboard-realtime') .on('postgres_changes', { event: 'UPDATE', schema: 'public', table: 'dashboard_state', filter: 'id=eq.main' }, (payload) => { console.log('Realtim ...[truncated 3208 chars]
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: assets/tier3-realtime.html:7
Finding: Mutable third-party JavaScript is executed without version pinning or integrity verification
Content: View full analysis
``` ### Technical Analysis The page loads and executes the Supabase client library from jsDelivr using the mutable major-version selector `@2`. No exact package version or Subresource Integrity hash is specified. This makes the effective executable code dependent on future CDN and package-registry state rather than the code reviewed in this project. A compromised package release, registry account, CDN response, or upstream publishing process could cause arbitrary JavaScript to execute whenever the dashboard loads. Because this script executes in the dashboard origin, it can inspect rendered operational data, read browser-accessible configuration, monitor user interaction, alter the interface, and issue network requests. ### Attack Path 1. An attacker compromises an upstream package release process, package registry account, or CDN delivery path. 2. Malicious code is published or served under the mutable `@supabase/supabase-js@2` URL. 3. A dashboard user loads the Tier 3 page. 4. The browser downloads and executes the modified script because no integrity hash is present. 5. The malicious dependency accesses dashboard data and performs actions with the privileges of page JavaScript. ### Impact Assessment A successful supply-chain compromise could affect every deployed dashboard that retains this URL. The attacker could: - Read all dashboard information available to the browser - Extract the Supabase project URL and anon ...[truncated 368 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: assets/push-dashboard.sh:30
Finding: Push script accepts and transmits arbitrary JSON despite documented safe-field assurances
Content: View full analysis
/dev/null 2>&1; then echo "Error: Invalid JSON input" >&2 exit 1 fi # Get current timestamp TIMESTAMP=$(date -u +%Y-%m-%dT%H:%M:%SZ) # Update the dashboard_state table using anon key RESPONSE=$(curl -s -w "\n%{http_code}" -X PATCH \ "$SUPABASE_URL/rest/v1/dashboard_state?id=eq.main" \ -H "apikey: $SUPABASE_ANON_KEY" \ -H "Authorization: Bearer $SUPABASE_ANON_KEY" \ -H "Content-Type: application/json" \ -H "Prefer: return=minimal" \ -d "{\"data\": $DATA, \"updated_at\": \"$TIMESTAMP\"}") ``` The documentation makes stronger claims than the implementation enforces: ```markdown All data stays on your machine. Only operational status data is pushed (task names, cron status, timestamps) — never credentials, API keys, or file contents. ``` ```markdown This is an instruction-only skill — no executable code, no install scripts, no third-party dependencies. ``` ### Technical Analysis The only input validation performed by the shell script is a call to `jq` that confirms the input is valid JSON. It does not enforce the documented dashboard schema, reject unknown fields, inspect values for credentials or personal information, limit payload size, or require user confirmation. As a result, any JSON supplied by a user, agent, pipeline, or redirected file is transmitted in full to the configured Supabase endpoint. This is necessary in principle for the external realtime dashboard, but the implementation does not enforce the clai ...[truncated 1407 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (13)

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 96)May include surrounding context.
md
In `tier3-realtime.html`:

Hidden Instructions

High

Category: Prompt Injection
Confidence: 70% confidence
Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
Content: Scanner excerpt · references/customization.md (reported line 92)May include surrounding context.
Custom Section

```

Hidden Instructions

High

Category: Prompt Injection
Confidence: 70% confidence
Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
Content: Scanner excerpt · references/customization.md (reported line 191)May include surrounding context.
html
<div class="card full-width">  </div>

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 95% confidence
Finding: The skill instructs use of shell-capable operations such as gh repo create, git push, vercel deploy, exporting environment variables, and curl, yet it does not declare a restrictive tool scope. That mismatch can cause the agent to request or exercise broader execution capability than users expect, increasing the risk of unintended command execution or repository/network changes.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The skill metadata claims all data stays on the user's machine and implies no external exposure, but the body explicitly describes publishing dashboard state to GitHub Pages, Supabase, and Vercel. This is dangerous because users and downstream policy systems may trust the misleading privacy claim and authorize the skill without understanding that operational data will be transmitted to third-party services.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The security section says the skill does not send data to third-party services, but elsewhere the skill instructs pushing status data to GitHub and Supabase. Contradictory security documentation undermines informed consent and can lead operators to expose internal task names, cron status, URLs, and error details under the false belief that no third-party transmission occurs.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 70% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · assets/push-dashboard.sh (reported line 44)May include surrounding context.
sh
TIMESTAMP=$(date -u +%Y-%m-%dT%H:%M:%SZ) # Update the dashboard_state table using anon key RESPONSE=$(curl -s -w "\n%{http_code}" -X PATCH \ "$SUPABASE_URL/rest/v1/dashboard_state?id=eq.main" \ -H "apikey: $SUPABASE_ANON_KEY" \ -H "Authorization: Bearer $SUPABASE_ANON_KEY" \

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 84% confidence
Finding: This HTML/JS code initializes a Supabase client and subscribes to realtime updates from the dashboard_state table, which transmits dashboard and activity data to the browser. Although the code logs connection events to the console, there is no user-facing notice in the UI, comment, or inline documentation explaining that remote operational data will be fetched and continuously streamed.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The customization guide demonstrates rendering data.customData into the DOM using innerHTML with unsanitized ${item.name} values. If that data can be influenced by an attacker or untrusted source, this creates a client-side XSS path where arbitrary HTML or script-capable payloads could execute in the dashboard viewer's browser.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The document declares lang="en", which hard-codes English as the page language. Under the policy, forcing a specific language without user opt-in or clear justification is a natural-language locale constraint.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 83% confidence
Finding: The page declares lang="en", which hard-codes the interface language/locale to English. There is no indication in the file that this is optional, configurable, or justified as a region-specific tool.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The page loads Google Fonts from external domains, which causes client browsers to make third-party network requests and disclose metadata such as IP address, user agent, and access timing. In the context of a supposedly local/PIN-protected operational dashboard, this weakens the claim that data stays local and introduces avoidable privacy and supply-chain exposure.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The document declares lang="en", which fixes the interface language to English, and all visible UI text is likewise English-only. There is no indication of user opt-in, locale selection, or documentation that this is a deliberately region-specific tool.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.

Overview

A.I.G

T09 · Insecure Skill Coding Practices

T09 · Insecure Skill Coding Practices

T08 · Insecure Dependencies

T09 · Insecure Skill Coding Practices

SkillSpector

Ae1

Hidden Instructions

Custom Section

Hidden Instructions

Undeclared Tool Scope

Description-Behavior Mismatch

Intent-Code Divergence

External Transmission

Missing User Warnings

Intent-Code Divergence

Natural-Language Policy Violations

Natural-Language Policy Violations

Missing User Warnings

Natural-Language Policy Violations

Static analysis