Webpage Screenshot New

• Outcome: Pass
• Latest audit: Sep 12, 2026 · 5:16 AM UTC
• Version: 1.0.0

Overview

This is a simple webpage screenshot skill with expected network and Puppeteer dependency use, with some documentation and dependency-pinning cautions but no evidence of hidden or malicious behavior.

Before installing, prefer a pinned Puppeteer version with a lockfile, run browser automation in a low-privilege or isolated environment, and avoid screenshotting untrusted, private, or internal URLs unless you are comfortable making a network request to that site.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:10

Finding

Unpinned Puppeteer Dependency Creates a Mutable Supply-Chain Risk

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:10
Vulnerability Type: Unpinned third-party dependency installation
Risk Level: Medium

Vulnerable code snippet:

bash

npm install puppeteer

Technical Analysis

The installation instruction does not specify an exact Puppeteer version. The project also has no declared dependencies or lockfile, making dependency resolution non-reproducible. Each execution of this command can install a different release from the configured npm registry.

This does not demonstrate that Puppeteer itself is malicious. However, it creates a supply-chain exposure because the code installed in the future may differ from the version reviewed during the audit. Package installation can also execute lifecycle scripts with the privileges of the user running npm.

Attack Path

1. An attacker compromises the relevant package publication channel, registry response, maintainer account, or dependency chain.
2. A malicious or compromised release becomes the version selected by npm.
3. A user follows the skill documentation and runs npm install puppeteer.
4. npm downloads the mutable dependency tree and may execute package lifecycle scripts.
5. The compromised package executes under the installing user's account or is loaded when the screenshot workflow runs.

Impact Assessment

Successful exploitation could allow arbitrary code execution with the privileges of the user performing installation or running the skill. Depending on that user's permissions, the affected scope could include project files, accessible credentials and environment variables, browser data, network-accessible resources, and other files writable by the account. No privilege escalation, persistence, or active malicious package was identified in the audited project.

Remediation

View remediation

Remediation Suggestions

1. Declare Puppeteer in package.json using an exact, reviewed version rather than an unbounded installation command.
2. Generate and commit package-lock.json so the complete transitive dependency graph and integrity hashes are fixed.
3. Replace the documented installation procedure with npm ci, which installs from the lockfile and rejects dependency manifest inconsistencies.
4. Review dependency updates before changing the pinned version or lockfile.
5. Run package installation and browser automation with a dedicated, least-privileged account or isolated container.
6. Where operationally practical, disable unnecessary npm lifecycle scripts during installation and explicitly approve packages that require them.
7. Configure npm to use a trusted registry and apply dependency vulnerability and provenance checks in continuous integration.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

A language or locale policy violation applies when a skill imposes one language without opt-in. Here, the instructions and usage text are entirely in Chinese, and there is no indication that the skill is region-specific or that users may choose another language.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The skill instructs visiting an arbitrary webpage to take a screenshot but does not disclose that this action generates a network request to the target site and may expose the user's IP, headers, cookies, or execution environment. In a browser-automation context, even a simple screenshot workflow causes external interaction, so the omission can lead to unintended privacy or network-boundary violations.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.