Security audit

Web Render Screenshot

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent screenshot tool, but its helper can open arbitrary URLs and file URLs in Chromium without safeguards, which deserves review before use on untrusted input.

Review this skill before installing in environments with access to private networks, local admin consoles, metadata services, or sensitive local files. Use it only with trusted HTML and trusted URLs, preferably in an isolated browser/container with network restrictions, and pin Playwright dependencies if you adopt it.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Error

Location: scripts/screenshot.py:24
Finding: Arbitrary URL Navigation Enables Server-Side Request Forgery
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Note

Location: scripts/screenshot.py:61
Finding: Unpinned Playwright and Chromium Installation Guidance Creates Supply-Chain Risk
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The skill explicitly supports rendering an HTML file path or URL and recommends Playwright navigation with network access, but it does not warn users that rendering may fetch remote resources or access arbitrary URLs. In an agent setting, this can lead to unintended outbound requests, privacy leakage, or access to internal-only endpoints if user-supplied HTML/URLs are rendered without restrictions.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The script accepts arbitrary http/https URLs and loads them in a real Chromium instance, despite being presented primarily as an HTML-to-screenshot utility. This expands the trust boundary from local rendering to live remote content fetching, which can trigger server-side request forgery behavior, unexpected network access, and rendering of attacker-controlled pages in environments that may have access to internal services or metadata endpoints.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Low

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The top-level usage string documents the positional input as <html_file>, suggesting local file rendering only. In contrast, the implementation accepts http:// and https:// inputs and navigates to them with Playwright, which is broader behavior than the documented interface describes.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.