Evenrealities Tracker

• Outcome: Pass
• Latest audit: Sep 10, 2026 · 3:36 PM UTC
• Version: 1.2.0

Overview

This skill is a coherent order-tracking automation, but users should understand it stores order data locally, prints personal order details, and submits them to Evenrealities' tracking site.

Install only if you are comfortable storing email/order IDs and status history under memory/ and submitting email plus order ID to track.evenrealities.com. Use restrictive file permissions, keep the memory files out of version control, consider masking logs, and pin Playwright before relying on this in automated or shared environments.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: requirements.txt:3

Finding

Unpinned Playwright Dependency and Unverified Browser Binary Download

Content

View full analysis

Vulnerability Details

File Location: requirements.txt:3-7
Vulnerability Type: Supply-chain exposure through unpinned executable dependencies
Risk Level: Medium

Complete Code Snippet:

text

playwright>=1.40.0

# Installation instructions:
# 1. pip install -r requirements.txt
# 2. playwright install
#    (This downloads browser binaries - ~300-500MB)

The same installation workflow is documented in SKILL.md:27-32:

bash

# Install Python packages
pip install -r skills/evenrealities-tracker/requirements.txt

# Install Playwright browsers (one-time, required for browser automation)
playwright install

Technical Analysis

The dependency declaration uses a lower-bound-only constraint, playwright>=1.40.0. Consequently, installations performed at different times may resolve to different releases, including versions that were not part of this audit.

The documented playwright install command also downloads executable browser artifacts. No package lock file, cryptographic hash verification, exact browser revision, or artifact-integrity procedure is provided. The effective executable dependency set can therefore change after the skill has been reviewed.

This is a supply-chain hardening weakness rather than evidence that the current Playwright package is malicious. Exploitation would require compromise of an upstream package, distribution channel, resolved future release, or downloaded browser artifact.

Attack Path

1. A user follows the documented setup instructions.
2. pip resolves the newest Playwright release satisfying >=1.40.0.
3. The selected package and its dependencies are downloaded and installed.
4. The user runs playwright install, retrieving executable browser binaries.
5. If an upstream package, dependency, release, distribution endpoint, or browser artifact has been compromised, attacker-controlled code is installed.
6. That code may execute dur ...[truncated 617 chars]

Remediation

View remediation

Remediation Suggestions

1. Replace the lower-bound constraint with an exact, reviewed version, for example playwright==<audited-version>.
2. Generate and commit a reproducible dependency lock file containing cryptographic hashes for Playwright and all transitive Python dependencies.
3. Install dependencies with hash enforcement, such as pip install --require-hashes -r requirements-lock.txt.
4. Pin and document the expected Playwright browser revision rather than relying on a moving browser payload.
5. Verify browser artifacts against publisher-provided checksums or signatures where supported.
6. Retrieve packages and browser binaries only from trusted, authenticated repositories.
7. Perform dependency updates through a controlled review process that includes vulnerability scanning, integrity verification, and regression testing.
8. Run installation and browser automation as an unprivileged, isolated user or inside a constrained container to reduce the impact of a supply-chain compromise.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (7)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 92% confidence

Finding

The core purpose mostly aligns: the code monitors Evenrealities orders, fills the tracker form in a browser, compares current status to saved history, and logs history to memory/evenrealities-status-history.json with change-only detection. However, there are material discrepancies in how that purpose is carried out and what is included in the skill itself. The description claims it uses fast-browser-use, but the code uses Playwright directly. It also claims Telegram notification behavior, but the script contains no Telegram integration and explicitly states notifications are handled elsewhere. Likewise, 'daily checks' suggests scheduling/trigger behavior, but the code only provides a command-line --check action with no built-in scheduler or triggers. Finally, it depends on a separate orders config file in memory/evenrealities-orders.json, which is an additional accessed resource not disclosed in the description. These differences are significant enough to count as a description-behavior mismatch, though the primary domain purpose remains related.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 70% confidence

Finding

Without declared permissions the skill's intent is opaque and cannot be validated.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The skill handles personal data—email addresses, order IDs, and status history—and sends the first two to a third-party tracking site while persisting both config and history locally. Without a prominent privacy warning, users may unknowingly expose personal order data to remote services or leave sensitive records on disk, increasing privacy and data-handling risk in shared environments.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The script logs full email addresses to stdout and submits them to a third-party tracking site, but it does not present any runtime notice, consent flow, or masking for this personal data. In agent or cron environments, console output is often centrally collected and retained, so exposing order emails can create unnecessary PII disclosure beyond the intended tracking function.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The README directs users to place personal data (email address and order identifier) into a local memory file but gives no warning about sensitivity, retention, file permissions, backups, or accidental exposure through logs, version control, or shared environments. In this skill's context, the data is not highly sensitive like credentials, but it is still personal/order-tracking data and the automation also creates a persistent status-history file, increasing privacy exposure over time.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The manifest description says the skill 'Uses fast-browser-use to fill the tracker form', but later documentation states 'The skill uses Playwright (direct, not via fast-browser-use)'. This is an active contradiction in the skill's stated implementation intent, not just an omitted detail.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 95% confidence

Finding

The requirement uses a lower-bound version specifier only, which allows future Playwright releases to be installed without review. This can introduce supply-chain and reliability risk if a later release changes behavior, breaks the automation, or ships a vulnerable version that the skill will automatically accept.

Content

Scanner excerpt · requirements.txt (reported line 3)May include surrounding context.

text

# Evenrealities Tracker Requirements

playwright>=1.40.0

# Installation instructions:
# 1. pip install -r requirements.txt

Static analysis

No suspicious patterns detected.