T09 · Insecure Skill Coding Practices
Error
- Location
amazon-search/amazon-search.js:64- Finding
Shell Command Injection Through the HOME Environment Variable
- Content
View full analysis
- Remediation
View remediation
Security audit
Playwright Cli Skills
Security checks for vulnerabilities and agentic risk
Overview
The skill is mostly a browser automation helper, but it bundles an under-disclosed Amazon authenticated scraping workflow and gives broad session, cookie, tracing, and package-install guidance without enough guardrails.
Install only if you are comfortable giving the agent broad browser-control capabilities and handling saved browser sessions as credentials. Avoid using real shopping, payment, or production accounts; protect or delete storage-state files; prefer pinned local dependencies over global npm installs; and review the Amazon helper before running it because it uses saved Amazon login state and writes untrusted product data into CSV files.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (4)
T09 · Insecure Skill Coding Practices
Error
- Location
amazon-search/amazon-search.sh:90- Finding
Predictable Temporary File Allows Symbolic-Link Overwrite
- Content
View full analysis
/dev/null | tee /tmp/amazon_output.txt sed -n '/CSV_DATA_START/,/CSV_DATA_END/p' /tmp/amazon_output.txt | grep -v "CSV_DATA" >> "$OUTPUT_FILE" ``` ### Technical Analysis The shell implementation stores command output at the fixed path `/tmp/amazon_output.txt`. The `/tmp` directory is normally writable by all local users. Because the filename is predictable and the script neither creates it atomically nor verifies its ownership and type, another local user can create the path before the script runs. The `tee` utility opens the destination for writing and normally follows symbolic links. Consequently, if `/tmp/amazon_output.txt` is a symbolic link, the linked target can be truncated or overwritten under the privileges of the user running the skill. The shared filename also causes data corruption and disclosure when multiple script instances run concurrently. ### Attack Path 1. A local attacker determines that another user or automation service will run `amazon-search.sh`. 2. Before execution, the attacker creates `/tmp/amazon_output.txt` as a symbolic link to a file writable by the victim account. 3. The victim runs the script. 4. `tee` follows the symbolic link and opens the target file for writing. 5. Product-search output truncates or overwrites the target. 6. The script subsequently reads from the attacker-selected target through the same predictable path. A second attack path involves concurrent executions: one process can replace or alter the shared file between the write and read operations, causing another user’s result data to be corrupted or disclosed. ### Impact Assessment Exploitation can overwrite or corrupt any file writable by the invoking user. If the script is executed by a privileged service account, the scop ...[truncated 553 chars]- Remediation
View remediation
/dev/null | tee "$TMP_FILE" sed -n '/CSV_DATA_START/,/CSV_DATA_END/p' "$TMP_FILE" | grep -v "CSV_DATA" >> "$OUTPUT_FILE" ``` Additional hardening should include: 1. Never use a fixed filename in a shared writable directory. 2. Quote every expansion containing a generated path. 3. Avoid running the script with elevated privileges. 4. Consider capturing output directly into a shell variable or piping it directly to the parser, eliminating the temporary file. 5. Enable strict shell behavior where compatible, such as `set -euo pipefail`. ]]>
T09 · Insecure Skill Coding Practices
Warning
- Location
amazon-search/amazon-search.js:107- Finding
Spreadsheet Formula Injection in Generated Product CSV Files
- Content
View full analysis
{ return `${p.rank},"${p.title}",${p.rating},${p.reviews},"${p.price}","${p.salesInfo}","${p.img}","${p.link}",${p.asin}`; }); const csvContent = [csvHeader, ...csvRows].join('\n'); fs.writeFileSync(outputFile, csvContent); ``` Shell implementation: ```javascript const csvRows = products.map(p => \ p.rank + ',' + '\"' + p.title + '\",' + p.rating + ',' + p.reviews + ',' + '\"' + p.price + '\",' + '\"' + p.salesInfo + '\",' + '\"' + p.img + '\",' + '\"' + p.link + '\",' + p.asin ).join('\\n'); ``` ### Technical Analysis The scripts export data obtained from Amazon pages directly into CSV cells. Although some fields are surrounded by double quotes, the implementations do not neutralize values beginning with characters interpreted as formulas by spreadsheet applications, including: - `=` - `+` - `-` - `@` - Tab or carriage-return characters CSV quoting is a serialization mechanism; it does not reliably prevent spreadsheet software from evaluating a quoted cell as a formula. The shell implementation also fails to escape embedded double quotes in remote fields. The Node.js implementation replaces double quotes only in the title, while other exported fields are inserted without comprehensive CSV escaping. This can allow crafted remote content to terminate a quoted field, create additional cells, or place a formula at the beginning of a new cell. ### Attack Path 1. An attacker controls or influences an Amazon product field that is included in search results, such as a title or other displayed product metadata. 2. The field is crafted to begin with spreadsheet formula syntax ...[truncated 1223 chars]- Remediation
View remediation
T08 · Insecure Dependencies
Warning
- Location
amazon-search/README.md:24- Finding
Inconsistent Unscoped Global Package Installation Creates Supply-Chain Risk
- Content
View full analysis
- Remediation
View remediation
``` Additional supply-chain hardening should include: 1. Pin an exact reviewed version rather than using `latest`. 2. Verify the package publisher and registry source. 3. Prefer a project-local dependency with a lockfile over a global installation. 4. Use `npm ci` with committed integrity metadata where a package project is available. 5. Remove every reference to unintended or obsolete package names. 6. Avoid elevated privileges for npm installation. 7. Document the expected executable and verify its resolved path before loading sensitive browser state. ]]>
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Memory PoisoningPersistent Context Injection, Context Window Stuffing, Memory Manipulation
- Rogue AgentSelf-Modification, Session Persistence
Findings (31)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 96% confidence
- Finding
The declared description suggests a general-purpose browser automation and Playwright testing skill. The code instead implements a specific Amazon scraping workflow: it loads an Amazon auth state file, visits Amazon search results, extracts product metadata, and saves structured output to disk. That is materially more specific than web-page testing and includes undeclared data extraction and file-generation behavior. While browser automation via Playwright is consistent at a high level, the primary purpose is not test automation but authenticated e-commerce scraping and CSV export, so this is a description-behavior mismatch.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
The declared description is broad and framed around browser automation and Playwright testing, but the code is not primarily a generic testing utility. It is a task-specific Amazon product search scraper that uses Playwright to access Amazon, extract structured product metadata, and save it as a CSV. It also loads a stored authentication state file (~/amazon-auth.json), which is a meaningful capability/resource access not reflected in the description. While browser automation via Playwright is technically involved, the actual behavior is materially more specific and includes scraping and local data export, so the description does not accurately represent the code's behavior.
- Content
Lp1
High
- Category
- MCP Least Privilege
- Confidence
- 75% confidence
- Finding
The skill uses 'env' capability that is not listed in its permissions. This may indicate deceptive intent or missing permission declarations.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The login example saves browser
storageStatetoauth.jsonwithout warning that the file may contain authentication cookies, local storage, and reusable session material. In a skill centered on arbitrary Playwright code execution, this is especially dangerous because it provides a ready-made pattern for persisting sensitive session state to disk where it could be leaked, reused, or committed to source control.- Content
Memory Manipulation
High
- Category
- Memory Poisoning
- Confidence
- 80% confidence
- Finding
Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.
- Content
md - Never commit storage state files containing auth tokens - Add `*.auth-state.json` to `.gitignore` - Delete state files after automation completes - Use environment variables for sensitive data - By default, sessions run in-memory mode which is safer for sensitive operations
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The example records a checkout flow while filling payment card fields, even though the document already explains that traces preserve screenshots, DOM state, and network bodies. This encourages users to create artifacts containing highly sensitive payment data, increasing the risk of PCI violations, accidental disclosure, and long-term retention of cardholder information in trace files.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The documentation explicitly teaches access to cookies, localStorage, sessionStorage, and even raw token extraction via
TOKEN=$(playwright-cli --raw cookie-get session_id)without any caution about secrets handling or user consent. In an agent setting, this normalizes credential harvesting patterns and raises the likelihood of accidental exposure, exfiltration, or misuse of authenticated session data.- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
bash playwright-cli route "**/*.jpg" --status=404 playwright-cli route "https://api.example.com/**" --body='{"mock": true}' playwright-cli route-list playwright-cli unroute "**/*.jpg" playwright-cli unroute
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The skill documents persistent profiles, snapshots, tracing, video recording, and deletion of browser data but does not warn that these features can store sensitive user content, credentials, browsing history, or remove important local data. In practice, recorded artifacts and persistent profiles often contain secrets and personal data, making this omission risky.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 89% confidence
- Finding
The documentation instructs use of
npx playwright-cliwithout a pinned package version, which allows execution of whatever version is currently resolved from the registry at runtime. In an agent skill context, this increases supply-chain risk and can lead to unexpected or malicious code execution if the package is updated, compromised, or typo-resolved.- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 96% confidence
- Finding
The installation guidance uses
npm install -g @playwright/cli@latest, and the surrounding text then relies onnpx playwright-clias a command path, both of which leave the executed version floating. In a tool-executing agent environment, unpinned global installation creates a clear supply-chain exposure and undermines reproducibility and reviewability.- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill documentation is written as a direct Chinese-only user instruction ('一键搜索亚马逊商品并生成 CSV 报告！') while the skill targets amazon.com and does not state that it is intended only for Chinese-speaking users. Under the policy, forcing a specific language without user opt-in is a natural-language locale violation.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill's operational instructions and warnings are presented entirely in Chinese, which effectively forces a language choice on users. There is no indication that the skill is region-specific or that users can opt into this locale.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The skill instructs the user to load a persisted Amazon authentication state file from the home directory without any warning that the file contains active session material equivalent to account access. In a browser automation context, reuse of saved auth state can expose shopping account data, order history, payment-adjacent flows, or enable unintended authenticated actions if the file is mishandled or used on a shared system.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
This code file contains user-facing console output in Chinese, including the primary error and usage guidance, with no indication that the skill is intended only for Chinese-speaking users or that another language is available. That creates a natural-language locale policy issue because the skill implicitly enforces a specific language without user opt-in.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The script automatically loads a persisted authenticated browser state from ~/amazon-auth.json and proceeds to access Amazon without any explicit notice, confirmation, or scope limitation. This can cause users to unknowingly run the automation with their logged-in account, exposing personal account context, enabling unintended authenticated actions, and increasing privacy and session-handling risk if the state file is stale, shared, or compromised.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 94% confidence
- Finding
The documentation instructs users to run
npx playwright test, which can resolve and execute a package version that is not explicitly pinned in the command context. If the local environment or package resolution is compromised, this can lead to execution of an unintended or malicious Playwright package version. In a skill that automates browser activity and debugging, that risk is more meaningful because users are being encouraged to run the command directly on their systems.- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 80% confidence
- Finding
This example uses
npx playwright testwithout showing any version pinning, so users may run whatever Playwright version resolves in their environment. While this is often normal developer documentation, it still creates a supply-chain exposure if package resolution is influenced by a malicious registry response, typo-squatting, or an unexpected dependency state. The adjacentnpm runexample is safer when backed by a lockfile, which makes the unpinnednpxpath comparatively weaker.- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 93% confidence
- Finding
The debug workflow tells users to run
npx playwright test --debug=cli, again relying on unpinned package execution. Because this command launches an interactive debugging session and encourages attachment to a live browser session, compromise of the executed package could expose local data, credentials, or browser-controlled workflows. The skill context increases the danger slightly because the command is presented as a hands-on operational step, not merely background reference text.- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The documentation explicitly demonstrates downloading a file and saving it to a local path using arbitrary Playwright code, but provides no warning that this modifies the local filesystem. In the context of a skill that advertises arbitrary browser automation via
run-code, this can normalize behavior that writes files to disk and may lead users or downstream agents to save untrusted content without scrutiny.- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The example shows granting
clipboard-readand reading clipboard contents without warning that the clipboard may contain sensitive secrets such as passwords, tokens, or personal data. Because this skill enables arbitrary Playwright code execution, documenting clipboard access without guardrails increases the risk of credential or data exposure during automation.- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The markdown documents
delete-datacommands that remove browser session profile data, but it does not warn that cookies, storage, history, and other persisted state may be permanently lost. Because this operation affects user data and is irreversible, the skill description should include an explicit caution before presenting the command examples.- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 88% confidence
- Finding
The documentation explicitly demonstrates saving browser session state, including cookies and localStorage, to a file and restoring it later. While this is a legitimate Playwright capability, it can persist authentication material and session tokens to disk, creating a credential exposure risk if the file is stolen, committed to source control, or reused improperly. The skill context makes this somewhat less suspicious because storage-state management is the stated purpose, but it is still security-sensitive due to the handling of authenticated sessions.
- Content
md playwright-cli open https://example.com playwright-cli eval "() => { document.cookie = 'session=abc123'; localStorage.setItem('user', 'john'); }" # Save state to file playwright-cli state-save my-session.json # ... later, in a new session ...
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The documentation includes generated test code with hardcoded credentials, including a plaintext password, and does not warn users against copying this pattern into real test suites. In a browser automation/test-generation skill, examples are likely to be reused directly, which can normalize insecure handling of secrets and lead to accidental credential exposure in source control, logs, or CI artifacts.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The tracing documentation explicitly states that traces capture full DOM snapshots, screenshots, network headers and bodies, and console output, but it provides no privacy or data-handling warning. In a browser automation skill, this is dangerous because traces can silently retain credentials, session tokens, personal data, and other secrets that may later be shared, stored, or exfiltrated.
- Content
Static analysis
Detected: suspicious.dangerous_exec
Shell command execution detected (child_process).
Critical
- Code
- suspicious.dangerous_exec
- Location
- amazon-search/amazon-search.js:65