Security audit

Redline Annotate

Security checks across malware telemetry and agentic risk

Overview

This is a useful local HTML annotation skill, but it installs persistent prompt hooks and exposes under-scoped local and browser execution paths that users should review before installing.

Install only if you are comfortable with a persistent Claude prompt hook, a localhost server, and annotated page content being stored locally and injected into model context. Use it on non-sensitive HTML, inspect ~/.claude/settings.json and .redline-inbox.json, uninstall or stop the server when finished, and prefer a revised version that bundles the finder script locally, restricts the server to a fixed project inbox with an auth token, and handles cleanup with validated code instead of an injected rm command.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (22)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 89% confidence
Finding: The skill advertises and relies on shell execution, file reads/writes, environment access, and local networking, yet it declares no permissions or equivalent trust boundary. That mismatch is dangerous because users and orchestrators cannot accurately assess the skill's real capabilities before installation or execution, especially since it starts a server, edits files, and installs hooks into the host Claude environment.

Context-Inappropriate Capability

Medium

Confidence: 94% confidence
Finding: Automatically writing a global UserPromptSubmit hook into ~/.claude/settings.json extends the skill's influence beyond the immediate HTML annotation task and into all future prompt submissions. This is risky because a global hook can silently inject context or alter behavior across unrelated projects, creating a persistence mechanism and broader attack surface than the user likely expects from a page-annotation tool.

Context-Inappropriate Capability

Low

Confidence: 94% confidence
Finding: Automatically writing a global UserPromptSubmit hook into ~/.claude/settings.json extends the skill's influence beyond the immediate HTML annotation task and into all future prompt submissions. This is risky because a global hook can silently inject context or alter behavior across unrelated projects, creating a persistence mechanism and broader attack surface than the user likely expects from a page-annotation tool.

Description-Behavior Mismatch

Medium

Confidence: 95% confidence
Finding: The skill dynamically injects and executes JavaScript from unpkg.com at runtime, which gives a third party effective code execution inside every annotated page. If the CDN, package, version, or delivery path is compromised, that remote script can access page content, localStorage, DOM state, and the annotation workflow, exceeding the stated local-only feedback model.

Context-Inappropriate Capability

Medium

Confidence: 96% confidence
Finding: Fetching code from unpkg.com introduces an external network dependency that is not necessary for the core local annotation flow and expands the trust boundary to a public CDN. Because the fetched asset is executable code, this is more serious than ordinary telemetry: it enables silent remote behavior changes and possible data access from the rendered page.

Description-Behavior Mismatch

Medium

Confidence: 93% confidence
Finding: The injected UI dynamically loads executable JavaScript from unpkg.com at runtime, introducing a third-party code execution path that is not necessary for a local annotation/local-server workflow. This creates a supply-chain and privacy risk because any compromise, drift, or unexpected behavior in the remote asset can execute in the page context and access annotated page content.

Context-Inappropriate Capability

Medium

Confidence: 89% confidence
Finding: The clipboard fallback copies the full annotation payload, including selectors, element HTML/text, file name, and comments, into the system clipboard without strong justification from the stated feature. Clipboard contents are globally accessible to other user actions and some applications, so sensitive page content may be unintentionally exposed beyond the local feedback channel.

Context-Inappropriate Capability

Medium

Confidence: 96% confidence
Finding: The injected UI dynamically loads JavaScript from a third-party CDN at runtime, giving remote code execution capability inside the annotated page context. If the CDN, package, or network path is compromised, attacker-controlled script could access page content, annotations, clipboard-related flows, and local browser state.

Description-Behavior Mismatch

Medium

Confidence: 95% confidence
Finding: The injected page code dynamically loads a third-party script from unpkg.com at runtime, which expands the skill's trust boundary beyond the described local-only annotation workflow. This creates supply-chain and privacy risk: a compromised CDN response or unexpected library behavior would execute in the page context and could access the annotated DOM and user feedback.

Context-Inappropriate Capability

Low

Confidence: 83% confidence
Finding: The UI stores annotations, element HTML/text, and comments in localStorage, which retains potentially sensitive page content longer than necessary for the stated feedback flow. On shared machines or in pages with other scripts under the same origin, this persistence can expose captured content beyond the user's immediate session.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The apply phase states that the model should edit the source HTML automatically when an inbox file is present, but the skill description does not prominently warn users that source files will be modified as a consequence of submitting annotations. This can lead to unexpected or unintended file changes, especially because the trigger is hook-driven and may occur when the user says an unrelated follow-up message.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The template mandates unconditional execution of `rm <inbox_path>` after applying edits, with no validation, confirmation, or path constraints. Because `inbox_path` is supplied through injected context, a malformed or adversarial value could cause deletion of an unintended file, and even in normal use it bakes in destructive behavior without user visibility.

Missing User Warnings

Medium

Confidence: 98% confidence
Finding: This hook silently reads a local `.redline-inbox.json` file and injects its contents into `additionalContext` for every user prompt before submission, without requiring fresh user confirmation or providing an in-band disclosure at the moment of injection. Because the inbox content can include task-shaping instructions such as editing files and deleting the inbox, any process or actor able to write that file can steer subsequent model behavior and cause unintended file modifications or prompt manipulation.

Missing User Warnings

Low

Confidence: 87% confidence
Finding: The injected context tells the model it '**must**' execute `rm {inbox_path}` via Bash after applying changes, but this destructive action is not separately surfaced to the user at execution time. Coupling hidden prompt injection with a deletion command increases the chance that evidence of the injected instructions is removed automatically, reducing transparency and making unintended or malicious inbox-driven actions harder to notice or audit.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: The skill submits annotations, including page-derived element HTML/text and user comments, to a local HTTP endpoint without an explicit consent prompt describing what data is being sent. Even though the destination is localhost, other local processes may read or proxy that data, and plain HTTP provides no authentication or confidentiality guarantees.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: On failure or missing configuration, the skill copies the full annotation payload to the clipboard without prior warning. Clipboard contents are globally accessible to the user and may be pasted into the wrong application or observed by clipboard-monitoring software, creating an unintended disclosure path for page-derived content and comments.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The installer silently edits the user's Claude settings.json to register a UserPromptSubmit hook, which changes how future prompts are processed without requiring explicit consent at the moment of modification. In this skill's context, that is more sensitive than a normal config tweak because hooks can automatically intercept or influence subsequent user interactions, so hidden persistence increases security and privacy risk.

Missing User Warnings

Low

Confidence: 86% confidence
Finding: The script creates or rewrites a symlink under ~/.claude/skills without an explicit pre-action warning, which can persistently alter the user's local Claude skill environment. While the operation is limited and not directly code-executing by itself, silently changing the loaded skill path can enable unintended behavior or replacement of an existing skill reference.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: The server accepts unauthenticated POST requests from any origin and writes attacker-controlled JSON to an attacker-specified path, as long as it is under the user's home directory or /tmp. Because this service is intended to interact with browser-rendered HTML and enables wildcard CORS, any local webpage or malicious site opened in the browser could potentially trigger silent writes to local files, which is dangerous even though the write target is somewhat constrained.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The skill posts collected annotations to a local HTTP endpoint, but the UI does not clearly disclose that submission includes page-derived data such as element HTML, text, selectors, and bounding boxes. Users may believe they are only submitting comments, causing unintentional disclosure of potentially sensitive content from the annotated page to another process.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: Loading third-party script without clear disclosure deprives the user of informed consent about external network access and remote code execution in the page. In a tool presented as local annotation functionality, this hidden network dependency increases trust risk and can expose page data to an unexpected external supply chain.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The code performs an external network script load without any user-facing disclosure, even though the skill description suggests a local workflow. Lack of transparency increases the chance that users expose page contents and interaction context to unanticipated external infrastructure and prevents informed consent.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.