Security audit

Html Mark

Security checks across malware telemetry and agentic risk

Overview

This skill is not malware, but it needs Review because it can run on arbitrary web pages, store page snippets locally, and package DOM content for external AI without strong privacy warnings.

Install only if you are comfortable with a page-context annotation tool. Use it on prototypes and pages you are authorized to review, avoid sensitive/authenticated pages, do not annotate fields containing secrets or personal data, clear stored annotations after use, and avoid the hosted bookmarklet unless you control and pin the script source.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Rogue AgentSelf-Modification, Session Persistence
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (12)

Context-Inappropriate Capability

Medium

Confidence: 91% confidence
Finding: The documentation includes a hosted remote-script bookmarklet that can load arbitrary JavaScript from `YOUR_HOST` into any visited page. That creates a code-injection and supply-chain risk well beyond the stated self-contained annotation use case, especially because users may run it on sensitive internal or third-party sites.

Intent-Code Divergence

Medium

Confidence: 84% confidence
Finding: The skill claims to be self-contained and single-file, yet later instructs users to load a remotely hosted script. This inconsistency can mislead users into trusting a deployment model that materially changes the threat surface by allowing post-publication code changes and external compromise.

Missing User Warnings

Medium

Confidence: 79% confidence
Finding: The bookmarklet guidance encourages use on 'any page' without warning that annotations may be stored in localStorage and may capture or persist sensitive content from third-party sites. This can lead users to run the tool on private/internal pages and later export selectors and HTML snippets into external AI tools, creating a realistic privacy and data leakage risk.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The bookmarklet is designed to run on arbitrary web pages and the skill explicitly exports element selectors and HTML snapshots for AI use, but it provides no privacy warning. On authenticated or confidential pages, this can capture page content, internal identifiers, or sensitive business data and encourage users to exfiltrate it via clipboard or external AI tools.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The script persists annotations, selectors, text snippets, and HTML snapshots in localStorage keyed by pathname, which can retain potentially sensitive page content on the client without any explicit notice or consent flow. On pages containing confidential UI text, form values, or internal markup, this creates unintended data retention that other scripts running on the same origin can read later.

Missing User Warnings

Medium

Confidence: 89% confidence
Finding: The export/copy feature packages captured selectors, text, and HTML snapshots into clipboard content specifically intended for pasting into external AI tools, but it does not warn users that page data may leave the local environment. This can lead to unintentional disclosure of proprietary or sensitive content when users paste exported annotations into third-party services.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The instructions tell users to install and run a bookmarklet on arbitrary pages without a clear warning that bookmarklets execute JavaScript in the context of the current site. That can modify page state, read visible DOM content, interact with authenticated sessions, and create safety and trust issues if users run it on sensitive pages.

Missing User Warnings

Low

Confidence: 94% confidence
Finding: The documented workflow modifies the target HTML file in place by injecting a script before </body>, but the example does not clearly warn the user that the original file will be rewritten. In a skill that operates on local files, lack of explicit disclosure can lead to unintended alteration of important prototypes or published artifacts, especially if the user expected a preview-only or non-destructive action.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The tool copies annotation exports to the clipboard, including captured element text and optional HTML snapshots, without warning the user that page content may contain sensitive data. On pages with secrets, PII, tokens, or internal content, this can lead to inadvertent disclosure when pasted into chat tools, tickets, or external systems.

Missing User Warnings

Medium

Confidence: 97% confidence
Finding: Annotations are persisted in localStorage and include notes, selectors, page text, and HTML snapshots. Because localStorage is readable by any script running on the same origin and persists across sessions, sensitive review data can be exposed to other application code, compromised third-party scripts, or later users of the same browser profile.

Ssd 3

Medium

Confidence: 96% confidence
Finding: The AI export mode is explicitly designed to send element selectors, captured page text, and HTML snapshots to an external coding agent. In this skill's context, that makes accidental exfiltration more likely because reviewers are encouraged to package raw DOM content for sharing outside the page's trust boundary.

Session Persistence

Medium

Category: Rogue Agent
Content: name: html-mark version: 1.2.0 title: HTML Mark — Click-to-annotate overlay for HTML prototypes description: Drop coral-gradient pins on any HTML page, write feedback in an inline glass note popup, copy out as Markdown / Plain / JSON — or a For-AI format (unique CSS selector + HTML snapshot per pin) built to paste into Claude Code for one-pass fixes. Pins anchor to their elements and persist in localStorage. Glass-morphism aesthetic, keyboard-friendly, self-contained single file. author: xuxinmaxen type: agent category: productivity
Confidence: 89% confidence
Finding: write feedback in an inline glass note popup, copy out as Markdown / Plain / JSON — or a For-AI format (unique CSS selector + HTML snapshot per pin) built to paste into Claude Code for one-pass fixes.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.