T03 · Remote Payload Retrieval and Execution
Error
- Location
scripts/setup.sh:280- Finding
Mutable Remote NodeSource Script Is Executed Through a Privileged Shell
- Content
View full analysis
- Remediation
View remediation
Security audit
Headful Browser (VNC)
Security checks for vulnerabilities and agentic risk
Overview
This skill has a coherent browser-automation purpose, but it captures authenticated browser session data and has under-scoped controls around local services, sensitive exports, and optional privileged installs.
Review before installing. Use this only in an isolated VM or tightly contained container, bind VNC and CDP to localhost, avoid logging into sensitive accounts unless exporting their session cookies is intentional, skip the auto-install path until curl|bash and eval are removed, set private output permissions, and delete exported cookies/pages promptly.
Vulnerability Patterns
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (4)
T09 · Insecure Skill Coding Practices
Error
- Location
scripts/_env_loader.sh:11- Finding
Skill Configuration Files Are Sourced as Arbitrary Shell Code
- Content
View full analysis
/dev/null || echo "000") if [ "${perms}" != "600" ] && [ "${perms}" != "400" ]; then echo "Warning: $ENV_FILE should be chmod 600 (found $perms). Continue anyway." >&2 fi set -a # shellcheck disable=SC1090 . "$ENV_FILE" set +a fi ``` The setup script independently uses the same unsafe pattern: ```bash load_env() { if [ -f "$ENV_FILE" ]; then set -a # shellcheck disable=SC1090 . "$ENV_FILE" set +a fi } ``` ### Technical Analysis The `.env` file is treated as an executable shell program rather than as a data-only configuration file. Shell sourcing accepts command substitutions, redirections, function definitions, command invocations, and other executable syntax. For example, a configuration entry such as the following would execute immediately when the file is sourced: ```bash OUT_DIR="$(arbitrary-command)" ``` The loader checks only the numeric permission mode and merely prints a warning when the mode is unsafe. It does not reject a group-writable or world-writable file, verify file ownership, reject symbolic links, or constrain allowed variable names and value syntax. Every helper that sources `_env_loader.sh` becomes an execution trigger, including VNC startup, Chrome startup, cookie export, page export, and shutdown. ### Attack Path 1. An attacker gains write access to the project-local `.env`, the fallback `.env`, or a path that can replace it. 2. The attacker inserts shell syntax, command substitution, or a direct command into the file. 3. A user invokes any script that sources `_env_loader.sh`, or invokes a setup workflow that calls `load_env`. ...[truncated 568 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Error
- Location
scripts/export_cookies.sh:7- Finding
Authentication Cookies and Rendered Page Artifacts Are Written Without Restrictive Permissions
- Content
View full analysis
/dev/null 2>&1; then SKILL_DIR="$(cd "$(dirname "$0")/.." && pwd)" if [ -f "$SKILL_DIR/tools/playwright_export.js" ]; then node "$SKILL_DIR/tools/playwright_export.js" "$WS_PORT" "$URL" "$OUTDIR" || true ``` The JavaScript exporter writes screenshots, page HTML, and cookies with process-default permissions: ```javascript try { await page.screenshot({path:`${outDir}/devtools_page.png`, fullPage:true}); } catch(e){} const content = await page.content(); const fs = require('fs'); fs.writeFileSync(`${outDir}/devtools_page.html`, content); fs.writeFileSync(`${outDir}/devtools_cookies.json`, JSON.stringify(await context.cookies(), null, 2)); ``` ### Technical Analysis No `umask 077`, directory mode `0700`, or file mode `0600` is applied. Consequently, permissions depend on the caller's ambient umask and any pre-existing output directory. A common umask of `022` can create files readable by other local users. The exported cookie JSON can contain bearer-like session credentials. Rendered HTML and screenshots can contain account details, personal information, anti-CSRF tokens, private messages, or other authenticated content. This conflicts with th ...[truncated 1212 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Error
- Location
scripts/start_vnc.sh:40- Finding
VNC and Browser-Control Services Are Not Explicitly Restricted to Loopback and Chrome Runs Without Its Sandbox
- Content
View full analysis
/dev/null 2>&1; then setsid x11vnc -display "$DISPLAY_VAL" -rfbauth "$VNC_PASS_FILE" -forever -shared -o ""$LOG"" & echo "x11vnc started (log: "$LOG")" fi ``` Chrome is started with remote debugging enabled and with its sandbox disabled: ```bash # Start chrome with remote debugging setsid nohup /usr/bin/google-chrome --user-data-dir="$PROFILE_DIR" "$PROXY_FLAG" --remote-debugging-port=""$REMOTE_PORT"" --no-first-run --no-default-browser-check --disable-extensions --disable-gpu --no-sandbox --window-size=1366,768 "${CHROME_EXTRA_FLAGS:-}" about:blank &> ""$LOG"" & ``` ### Technical Analysis The VNC invocation does not use an explicit loopback-only option such as `-localhost`. Therefore, its reachability depends on x11vnc defaults, host networking, firewall policy, and container port publication rather than being enforced by the Skill. Chrome enables the DevTools Protocol, which provides extensive browser control, including page navigation, script execution in browser contexts, and access to session information. The script does not explicitly provide a loopback debugging address. Even where a particular Chrome version defaults to loopback, relying on defaults is weaker than enforcing and verifying the intended boundary. The `--no-sandbox` flag disables a major defense against malicious or compromised web content. This is especially risky because the Skill is specifically intended to load arbitrary websites and interact with challenge and authentication pages. VNC password authentication mitigates unauthenticated VNC access, but it does not provide transport encryption and do ...[truncated 1338 chars]- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
- YARA SignaturesMalware Match, Webshell Match, Cryptominer Match
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (66)
YARA rule 'info_stealer': Information stealer patterns (credential harvesting, browser data theft) [malware]
High
- Category
- YARA Match
- Confidence
- 92% confidence
- Finding
The skill explicitly supports exporting Chrome cookies, rendered HTML, and screenshots from a live browser session after manual login or MFA intervention. Even if intended for legitimate automation, this creates a powerful credential/session-harvesting capability that could be abused to capture authenticated sessions, bypass user intent, and exfiltrate sensitive data from browser state.
- Content
md er X display provided by `Xvfb`. - **Operator UI**: present the running browser to an operator via `x11vnc` (or optional noVNC web proxy). Operators can connect over SSH-forwarded ports or noVNC with token gating to perform manual actions (solve CAPTCHAs, authenticate), then signal the system to capture artifacts. - **Programmatic capture**: export rendered `outerHTML`, full-page screenshots, and cookies using Chrome CDP (Playwright/Puppeteer compatible). Exports are intended for downstream automated analysis or storage. - **Safe restart and recovery**: helpers to restart Chrome when flags change, with explicit user confirmation required for any action that may terminate existing browser instances. - **Artifact hygiene**: captured artifacts are written to an artifacts directory with restrictive file permissions. The skill logs actions and writes diagnostic artifacts to facilitate debugging and comparison-based analysis. ## Security, privacy, and operational notes - **VNC security**:
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
The skill description understates that it includes interactive setup, .env creation/modification, VNC credential generation, and optional package-manager execution. Those behaviors materially change the trust model because they can alter the host, create secrets, and install software, all of which are more dangerous than a simple browser-export utility.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The skill description understates that it includes interactive setup, .env creation/modification, VNC credential generation, and optional package-manager execution. Those behaviors materially change the trust model because they can alter the host, create secrets, and install software, all of which are more dangerous than a simple browser-export utility.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
The skill description understates that it includes interactive setup, .env creation/modification, VNC credential generation, and optional package-manager execution. Those behaviors materially change the trust model because they can alter the host, create secrets, and install software, all of which are more dangerous than a simple browser-export utility.
- Content
YARA rule 'info_stealer': Information stealer patterns (credential harvesting, browser data theft) [malware]
High
- Category
- YARA Match
- Confidence
- 95% confidence
- Finding
The skill explicitly exports browser cookies, rendered HTML, and screenshots from an operator-driven authenticated session. Those capabilities closely match information-stealer behavior because they enable extraction of session tokens and sensitive page content; even if intended for legitimate automation, compromise or misuse would directly expose account access and confidential data.
- Content
md er X display provided by `Xvfb`. - **Operator UI**: present the running browser to an operator via `x11vnc` (or optional noVNC web proxy). Operators can connect over SSH-forwarded ports or noVNC with token gating to perform manual actions (solve CAPTCHAs, authenticate), then signal the system to capture artifacts. - **Programmatic capture**: export rendered `outerHTML`, full-page screenshots, and cookies using Chrome CDP (Playwright/Puppeteer compatible). Exports are intended for downstream automated analysis or storage. - **Safe restart and recovery**: helpers to restart Chrome when flags change, with explicit user confirmation required for any action that may terminate existing browser instances. - **Artifact hygiene**: captured artifacts are written to an artifacts directory with restrictive file permissions. The skill logs actions and writes diagnostic artifacts to facilitate debugging and comparison-based analysis. ## Security, privacy, and operational notes - **VNC security**:
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md Include an appropriate `LICENSE` file when publishing (e.g., MIT). Update author/maintainer fields in `SKILL.md` prior to external publication.
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 88% confidence
- Finding
The skill explicitly manages sensitive material including VNC passfiles, .env contents, and browser session artifacts such as cookies. In this context, references to .env are not harmless because the skill's stated functionality includes collecting and storing authentication-related data that could expose credentials or session tokens if mishandled.
- Content
md nodejs npm python3-pip --- Missing requirements: Xvfb x11vnc chrome node VNC_PASSFILE .env --- Handling missing: Xvfb --- Install Xvfb? (y/N) n Skip. Manual: sudo apt-get install xvfb
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 82% confidence
- Finding
Creating a template .env is not inherently malicious, but in this skill it may normalize storing operational secrets and ports in a local file that later scripts will consume. Because the skill also exposes VNC and CDP interfaces, weak handling of that file could facilitate session takeover or unauthorized browser access.
- Content
--- Handling missing: node --- Install Node.js v22+ using suggested command? (y/N) n Skipped automatic install. Please run the printed command manually. --- Handling missing: .env --- Create template .env? (y/N) y Created skills/headful-browser-vnc/.env
text
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 82% confidence
- Finding
The creation of a local .env file is a credential-handling concern in this skill because it centralizes security-relevant configuration for VNC, proxies, and debugging endpoints. If the file is left readable or checked into source control, it can leak access details that materially weaken the environment.
- Content
Skipped automatic install. Please run the printed command manually. --- Handling missing: .env --- Create template .env? (y/N) y Created skills/headful-browser-vnc/.env
text
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md SKILL_DIR=/ #!/usr/bin/env bash # load .env if present (non-destructive). Exports variables to child processes. # Prefer a .env colocated with the skill scripts directory; fall back to parent for backward-compat. SKILL_DIR="$(cd "$(dirname "$0")" && pwd)" ENV_FILE="$SKILL_DIR/.env"
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md SKILL_DIR=/ #!/usr/bin/env bash # load .env if present (non-destructive). Exports variables to child processes. # Prefer a .env colocated with the skill scripts directory; fall back to parent for backward-compat. SKILL_DIR="$(cd "$(dirname "$0")" && pwd)" ENV_FILE="$SKILL_DIR/.env"
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md SKILL_DIR=/ #!/usr/bin/env bash # load .env if present (non-destructive). Exports variables to child processes. # Prefer a .env colocated with the skill scripts directory; fall back to parent for backward-compat. SKILL_DIR="$(cd "$(dirname "$0")" && pwd)" ENV_FILE="$SKILL_DIR/.env"
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md SKILL_DIR=/ #!/usr/bin/env bash # load .env if present (non-destructive). Exports variables to child processes. # Prefer a .env colocated with the skill scripts directory; fall back to parent for backward-compat. SKILL_DIR="$(cd "$(dirname "$0")" && pwd)" ENV_FILE="$SKILL_DIR/.env"
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
sh SKILL_DIR=/ #!/usr/bin/env bash # load .env if present (non-destructive). Exports variables to child processes. # Prefer a .env colocated with the skill scripts directory; fall back to parent for backward-compat. SKILL_DIR="$(cd "$(dirname "$0")" && pwd)" ENV_FILE="$SKILL_DIR/.env"
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
sh SKILL_DIR=/ #!/usr/bin/env bash # load .env if present (non-destructive). Exports variables to child processes. # Prefer a .env colocated with the skill scripts directory; fall back to parent for backward-compat. SKILL_DIR="$(cd "$(dirname "$0")" && pwd)" ENV_FILE="$SKILL_DIR/.env"
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 66% confidence
- Finding
The script automatically sources a local .env file and exports all variables to child processes. In a skill that exposes Chrome CDP exports and browser automation, this increases the chance that sensitive tokens or credentials from .env are broadly propagated into subprocesses and become accessible to other components, debug interfaces, or accidental logging.
- Content
sh SKILL_DIR=/ #!/usr/bin/env bash # load .env if present (non-destructive). Exports variables to child processes. # Prefer a .env colocated with the skill scripts directory; fall back to parent for backward-compat. SKILL_DIR="$(cd "$(dirname "$0")" && pwd)" ENV_FILE="$SKILL_DIR/.env" if [ ! -f "$ENV_FILE" ]; then
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 77% confidence
- Finding
The fallback to '$SKILL_DIR/../.env' expands the trust boundary beyond the script directory and can cause the script to ingest secrets or attacker-controlled environment data from a parent directory. If the parent directory is less controlled, this can lead to configuration injection, credential exposure to child processes, or unsafe behavior in downstream tools.
- Content
sh # load .env if present (non-destructive). Exports variables to child processes. # Prefer a .env colocated with the skill scripts directory; fall back to parent for backward-compat. SKILL_DIR="$(cd "$(dirname "$0")" && pwd)" ENV_FILE="$SKILL_DIR/.env" if [ ! -f "$ENV_FILE" ]; then # backward-compat fallback ENV_FILE="$SKILL_DIR/../.env"
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 84% confidence
- Finding
Conditionally sourcing the discovered .env file means arbitrary shell syntax in that file will be executed in the current shell context, not merely parsed as key-value pairs. In a security-sensitive browser automation skill, this is more dangerous because compromised workspace content or an untrusted .env could execute commands, alter runtime behavior, and expose credentials through inherited environment variables.
- Content
sh ENV_FILE="$SKILL_DIR/.env" if [ ! -f "$ENV_FILE" ]; then # backward-compat fallback ENV_FILE="$SKILL_DIR/../.env" fi if [ -f "$ENV_FILE" ]; then # ensure restrictive permissions
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
sh # Resolve ENV_FILE path (skill-local preferred, fallback to parent) SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)" ENV_FILE="$SCRIPT_DIR/.env" if [ ! -f "$ENV_FILE" ]; then ENV_FILE="$(dirname "$SCRIPT_DIR")/.env" fi
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
sh # Resolve ENV_FILE path (skill-local preferred, fallback to parent) SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)" ENV_FILE="$SCRIPT_DIR/.env" if [ ! -f "$ENV_FILE" ]; then ENV_FILE="$(dirname "$SCRIPT_DIR")/.env" fi
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
sh # Resolve ENV_FILE path (skill-local preferred, fallback to parent) SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)" ENV_FILE="$SCRIPT_DIR/.env" if [ ! -f "$ENV_FILE" ]; then ENV_FILE="$(dirname "$SCRIPT_DIR")/.env" fi
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 85% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
sh fontconfig freetype Arch Linux (pacman): pacman -Syu --noconfirm xorg-server-xvfb x11vnc fluxbox xorg-x11-utils \ chromium nodejs npm python-pip noto-fonts-cjk Notes:
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 87% confidence
- Finding
The script constructs an executable pacman command using --noconfirm and later runs it with eval in auto-install mode. In an agent skill, allowing unattended package-manager actions weakens operator control and can amplify the impact of accidental or manipulated installation flows.
- Content
sh " ;; arch) cmd_xvfb="${PKG_PREFIX}pacman -Syu --noconfirm xorg-server-xvfb" cmd_x11vnc="${PKG_PREFIX}pacman -S --noconfirm x11vnc" cmd_chrome="${PKG_PREFIX}pacman -S --noconfirm chromium || true" cmd_node="${PKG_PREFIX}pacman -S --noconfirm nodejs npm"
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 87% confidence
- Finding
This x11vnc install command uses a noninteractive pacman flag in an execution path that can perform system changes. Even with outer prompts, disabling the tool's native confirmation reduces a safety barrier for privileged modifications.
- Content
sh ;; arch) cmd_xvfb="${PKG_PREFIX}pacman -Syu --noconfirm xorg-server-xvfb" cmd_x11vnc="${PKG_PREFIX}pacman -S --noconfirm x11vnc" cmd_chrome="${PKG_PREFIX}pacman -S --noconfirm chromium || true" cmd_node="${PKG_PREFIX}pacman -S --noconfirm nodejs npm" ;;
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 87% confidence
- Finding
This chromium install command combines --noconfirm with eval-based execution and also suppresses failure via '|| true'. That combination can hide unsuccessful or partial package actions while still enabling unattended system modification.
- Content
sh arch) cmd_xvfb="${PKG_PREFIX}pacman -Syu --noconfirm xorg-server-xvfb" cmd_x11vnc="${PKG_PREFIX}pacman -S --noconfirm x11vnc" cmd_chrome="${PKG_PREFIX}pacman -S --noconfirm chromium || true" cmd_node="${PKG_PREFIX}pacman -S --noconfirm nodejs npm" ;; alpine)
Static analysis
No suspicious patterns detected.