Security audit

Dogfood

Security checks for vulnerabilities and agentic risk

Overview

This is a coherent web QA skill, but it needs Review because it handles login credentials, saves reusable auth state, and permits risky command patterns.

Install only if you are comfortable with automated browser testing against the target app. Prefer local or staging targets, use least-privileged test accounts, avoid production credentials, keep the output directory private, do not share auth-state.json, and remove or pin the npx agent-browser allowance before relying on it.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (3)

T09 · Insecure Skill Coding Practices

Error

Location: SKILL.md:37
Finding: Shell Command Injection Through Unquoted Dynamic Parameters
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.md:64
Finding: Authentication Credentials Exposed in Process Arguments and Execution Logs
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.md:75
Finding: Reusable Authentication State Stored Without Access or Retention Controls
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (7)

Rp1

Medium

Category: MCP Rug Pull
Confidence: 98% confidence
Finding: The skill manifest references an MCP/tool execution path via npx agent-browser without version pinning. That exposes users to package drift and potential supply-chain compromise, especially because skills are meant to automate execution and may run without close review each time.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The trigger phrases are broad enough that the skill could activate on ordinary requests about reviewing or testing a site, causing an agent to launch high-impact browser automation unexpectedly. In this skill's context, activation can lead to navigation, interaction, screenshotting, console inspection, and persistence of artifacts, so accidental invocation increases operational and privacy risk.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 97% confidence
Finding: The manifest permits Bash(npx agent-browser:*), which allows execution of an unpinned package from the npm ecosystem. Even though the document text prefers the direct binary, leaving the npx path available creates a supply-chain risk if the package or resolution path is compromised or changes unexpectedly.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 70% confidence
Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The skill instructs saving authenticated browser state to disk as auth-state.json without warning the user or specifying storage protections, retention, or cleanup. Session state may contain cookies or tokens that can be reused to access the target account, making this especially sensitive in a QA skill that routinely authenticates into real applications.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Low

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The inline documentation actively forbids using npx agent-browser, stating it should never be used. Yet the same skill manifest declares Bash(npx agent-browser:*) as an allowed tool, which contradicts the documented intent about how the skill should operate.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Low

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The guidance explicitly instructs the operator to use type rather than fill when recording video so input appears human-paced. However, the concrete command examples for login and repro actions only demonstrate fill, which contradicts that stated instruction and could lead operators to follow behavior the documentation says not to use.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.