Tp1
High
- Category
- MCP Tool Poisoning
- Confidence
- 85% confidence
- Finding
Zero-width Unicode characters are invisible to humans but detectable by AI. When followed by visible text, they indicate hidden content injection.
- Content
Security audit
Web Module Runner
Security checks for vulnerabilities and agentic risk
Overview
The skill is presented as a web development runner, but its artifacts mainly define a local activity logger that records arbitrary user input for later search/export.
Review before installing. Do not enter secrets, tokens, private paths, or sensitive project details unless you are comfortable with them being written to local history files and potentially exported later. The package looks more like a local audit/logbook tool than a true web module runner.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- YARA SignaturesMalware Match, Webshell Match, Cryptominer Match
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (8)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The skill markets itself as a development tool for running and analyzing web modules, but the documented behavior is primarily persistent logging, history tracking, search, and export of user-provided inputs. This mismatch is dangerous because users may provide sensitive project details, commands, dependency names, or internal configuration data under the assumption they are invoking a transient dev utility, while the skill instead retains and republishes that data locally.
- Content
YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]
High
- Category
- YARA Match
- Confidence
- 80% confidence
- Finding
YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).
- Content
md --- version: "1.0.0" name: Wmr description: "👩🚀 The tiny all-in-one development tool for modern web apps. web-module-runner, javascript, build-tool, esmodules, preact." --- # Web Module Runner 👩🚀 The tiny all-in-one development tool for modern web apps — a versatile utility toolkit for running, checking, converting, analyzing, and managing web module tasks from your terminal. ## Commands All commands accept optional `<input>` arguments. Without arguments, they display recent entries from their log. | Command | Description | |---------|-------------| | `web-module-runner run <input>` | Run a web modu
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The script’s behavior materially differs from the advertised developer-tool purpose: instead of performing web-app development tasks, it primarily collects arbitrary user input and stores it persistently in per-command logs. That mismatch is dangerous in an agent-skill context because users may provide project paths, tokens, config values, or other sensitive material under false assumptions about the tool’s function, enabling covert data harvesting.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The script is structured around persistent capture, indexing, and later retrieval/export of arbitrary user-provided data across many command names, which resembles a local data collection utility more than the advertised development tool. In the skill context, this is more dangerous because the broad command surface can normalize repeated data entry and make later exfiltration or disclosure of sensitive user content much easier.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The help text advertises operational commands such as export and status, but the main dispatcher routes those same names to branches that log arbitrary input instead of performing the documented actions. In a security review, this deceptive command wiring increases the likelihood that users will enter sensitive data expecting normal tool behavior, while the script quietly retains that data for later search/export.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
User-supplied input is appended verbatim to persistent local logs without any warning, redaction, retention control, or sensitivity filtering. In practice, users often paste credentials, internal paths, URLs, or incident details into CLI tools, so silent storage creates avoidable confidentiality risk, especially when combined with built-in search and export features.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The skill documentation notes local storage later in the file, but it does not prominently warn in the description or command interface that user-supplied inputs and activity history are persistently logged. This creates a privacy and data-handling risk because users may enter sensitive build commands, file paths, tokens, or internal project details without informed consent.
- Content
Static analysis
No suspicious patterns detected.