Analytics Dashboard Free

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:29 AM UTC
• Version: 1.0.0

Overview

This local dashboard has a coherent purpose, but it handles sensitive status data with risky token, logging, and optional network exposure guidance that users should review before installing.

Install only if you are comfortable running a local Node/Express dashboard that reads inbox, browser-session, and task-status files. Keep it bound to 127.0.0.1, avoid token-in-URL use when possible, do not expose it over plain HTTP, restrict access to logs, and review or supply the missing server implementation before use.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:73

Finding

Unverified npm Dependency Installation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:73 and SKILL.md:315
Vulnerability Type: Supply-chain exposure through runtime dependency installation
Risk Level: Medium

Vulnerable Code Snippet

bash

npm install express@4.21.2

The same installation requirement is repeated in the dependency table:

text

Express | npm package | Required | npm install express@4.21.2

Technical Analysis

The Skill instructs the Agent to download and install Express directly from the configured npm registry. Although the dependency name is conventional and the direct version is pinned, the project provides no lockfile, package integrity hash, vendored dependency, or server implementation against which the dependency tree can be verified.

An npm installation may process transitive packages and package lifecycle scripts with the privileges of the user running the Agent. Version pinning alone does not validate package integrity or fully constrain transitive dependencies.

The audit found no evidence that express@4.21.2 is malicious. The confirmed issue is that the installation procedure lacks supply-chain verification and hardening.

Attack Path

1. The user invokes the Skill and follows its setup instructions.
2. The Agent executes npm install express@4.21.2.
3. npm contacts the configured package registry and resolves the package and its transitive dependencies.
4. If the registry, local npm configuration, package artifact, or a transitive dependency has been compromised, attacker-controlled package content may be installed.
5. Any permitted lifecycle script executes with the Agent user's local privileges.

Impact Assessment

Successful exploitation could execute arbitrary code with the privileges of the user running npm. This may permit access to files available to that account, including the dashboard's email, session, task, configuration, and log data.

The scope is limited by the i ...[truncated 139 chars]

Remediation

View remediation

Remediation Suggestions

1. Include the complete, auditable server source in the Skill package.
2. Commit a package lockfile and use npm ci rather than unconstrained installation.
3. Record and verify dependency integrity hashes.
4. Use npm ci --ignore-scripts when lifecycle scripts are not required.
5. Document the expected npm registry and reject unexpected registry overrides.
6. Audit both direct and transitive dependencies before release.
7. Run dependency installation and the dashboard under a dedicated, minimally privileged account or sandbox.

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:167

Finding

Dashboard Authentication Token Exposed Through Query Strings and Request Logging

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:167-184
Vulnerability Type: Authentication-token disclosure
Risk Level: High

Vulnerable Code Snippet

bash

# Default generated-token output
node server.js
# Output: http://127.0.0.1:19195/?token=a3f9c2...

# Custom token
export DASHBOARD_TOKEN="my-secret-token"
node server.js
# Output: http://127.0.0.1:19195/?token=my-secret-token

The documented authentication and logging behavior includes:

text

Authentication option: URL query parameter, ?token=xxx
The token is stored in localStorage and removed from the URL after loading.
Access logs record all requests.

Technical Analysis

Placing an authentication credential in a URL query string can disclose it through browser history, initial HTTP request logs, copied links, screenshots, monitoring systems, and potentially referrer information. Removing the query parameter after the page loads does not remove records produced by the initial request.

The Skill additionally states that all requests are recorded in access logs. If the logger stores the original request target, the tokenized URL will be written to disk. Because no server implementation is included, the exact log format cannot be verified; nevertheless, the documented combination of query-string authentication and comprehensive request logging creates a direct credential-disclosure risk.

Storage in localStorage also exposes the token to any script executing in the dashboard origin. The absent implementation prevents verification of output encoding, content-security policy, or resistance to cross-site scripting.

Attack Path

1. The dashboard generates or accepts a secret token.
2. The user opens a URL containing ?token=secret.
3. The initial request target is retained in browser history or recorded by the documented access logger.
4. Another local user, support bundle recipient, backup reader, log collector, ...[truncated 723 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove query-string token authentication entirely.
2. Establish authenticated sessions through a dedicated login endpoint.
3. Store session identifiers in cookies configured with HttpOnly, Secure, and an appropriate SameSite policy.
4. Never place credentials in printed URLs, browser history, or command output.
5. Configure logging to exclude query strings and redact authorization headers, cookies, and token-like values.
6. Rotate tokens after suspected disclosure and support short expiration periods.
7. Avoid persistent token storage in localStorage.
8. Add restrictive content-security policy and robust output encoding to reduce token theft through script injection.
9. Set restrictive filesystem permissions and retention limits on access logs.

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:294

Finding

Sensitive Dashboard Can Be Exposed on All Interfaces over Plaintext HTTP

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:294
Vulnerability Type: Insecure network exposure of sensitive data and bearer credentials
Risk Level: High

Vulnerable Code Snippet

English translation of the documented remote-access instruction:

text

The dashboard binds to 127.0.0.1 by default and is locally accessible only.
For external access, change the host in config.json to 0.0.0.0.
Ensure that the token is sufficiently complex and consider using a reverse
proxy, such as nginx, to add HTTPS.

Technical Analysis

Binding the dashboard to 0.0.0.0 makes it listen on available network interfaces. The guidance treats HTTPS as optional while the documented examples use plaintext HTTP and bearer-style tokens.

Token complexity does not protect credentials from passive traffic interception. On an untrusted or shared network, an observer able to inspect plaintext traffic may recover both the dashboard token and displayed data. Exposing the port also expands the attack surface from local processes to any network host that can route to the service.

The dashboard is intended to aggregate potentially sensitive email metadata, browser-session state, and task information. This exposure is therefore broader than the minimum privileges required for the declared local visualization function.

Attack Path

1. A user follows the remote-access instructions and changes the host from 127.0.0.1 to 0.0.0.0.
2. The dashboard listens on external interfaces without mandatory TLS.
3. The user authenticates or refreshes data over plaintext HTTP.
4. A network-positioned attacker captures the token or dashboard responses, or directly probes the exposed port.
5. The attacker reuses the captured token while it remains valid.
6. The attacker reads dashboard data available under the compromised session.

Direct probing alone still requires a valid token unless another implementation flaw exists. Traffic i ...[truncated 507 chars]

Remediation

View remediation

Remediation Suggestions

1. Enforce loopback-only binding by default.
2. Require explicit user confirmation before accepting a non-loopback host.
3. Refuse non-loopback startup unless TLS is configured or the service is behind a trusted TLS-terminating reverse proxy.
4. Replace plaintext HTTP examples for remote access with HTTPS-only examples.
5. Restrict inbound access with host firewalls, network allowlists, or a private authenticated network.
6. Add short-lived sessions, token rotation, authentication rate limiting, and failed-login monitoring.
7. Validate proxy configuration and trusted-proxy settings to prevent header spoofing.
8. Clearly warn that binding to 0.0.0.0 exposes the service beyond the local machine.
9. Do not treat token complexity as a substitute for transport encryption.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (7)

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill states that all requests are logged while also supporting token transmission via URL parameters. If request logs capture full URLs or headers, authentication tokens for a dashboard aggregating sensitive inbox/session/task data may be stored in plaintext in access.log and exposed to other local users, backups, or support artifacts.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The invocation description is broad enough to trigger on generic analysis, reporting, statistics, or visualization requests, which can cause the skill to be selected in contexts beyond its narrow dashboard-hosting purpose. In an agent ecosystem, overbroad matching is dangerous because it may unnecessarily invoke read/write/exec-capable tooling for tasks that do not require those permissions.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The skill explicitly claims a 'read-only safety principle' and 'does not modify any data', yet elsewhere documents automatic directory creation and access-log writes. This is a real integrity/transparency issue because operators may grant the skill higher trust or run it in sensitive environments under a false assumption that it performs no writes.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The documentation omits a clear warning that setup and operation create directories, logs, and possibly config/state files. This can mislead users into approving execution under an incorrect mental model, especially in automated agent contexts where filesystem side effects should be explicitly disclosed before using write/exec tools.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The documentation frames the dashboard as a local, token-protected monitor, but then instructs users to bind to 0.0.0.0 for Internet access. Exposing a dashboard that aggregates inbox, session, and task data materially increases attack surface, and token-in-URL authentication is especially risky when used beyond localhost.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The license section explicitly highlights '完全中文化表达' as a design change, and the document is written to enforce a Chinese-localized experience without stating that users may choose another language. This is a natural-language locale restriction without opt-in or a documented region-specific justification.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Low

• Category: Not specified by scanner
• Confidence: 79% confidence

Finding

L382 指导执行 ping 测试网络连通性、检查防火墙和代理，且 L294 还涉及对外开放服务。这些网络诊断/暴露能力更像通用运维操作，不是该技能“读取本地数据并展示”的核心或直接必要实现。

Content

No source excerpt is available for this finding.