Security audit

privacy-scraper

Security checks for vulnerabilities and agentic risk

Overview

The skill’s privacy promises conflict with instructions that permit decrypted temporary files and declare redacted excerpts safe to share.

Review before installing for sensitive work. Do not rely on the zero-disk-write or guaranteed-wiping claims. Excerpts are saved by default; inspect them for personal and confidential information before sharing. Verify the actual command’s implementation and retention behavior.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Output HandlingUnvalidated Output Injection, Cross-Context Output, Unbounded Output
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (4)

The sharing workflow declares excerpts safe without warning that PII removal does not ensure removal of all sensitive information.

High

Category: Output Handling
Confidence: 99% confidence
Finding: The workflow labels excerpts safe to share and claims they contain zero sensitive information solely because PII removal is enabled. Pattern-based PII removal can miss identifiers and does not remove all confidential information, so this assurance could induce disclosure of sensitive material, especially given the skill's privacy and compliance positioning.
Content: No source excerpt is available for this finding.

The retrieval workflow permits plaintext temporary-file output while assuring users that retrieval writes nothing to disk.

High

Category: Output Handling
Confidence: 99% confidence
Finding: The zero-disk-write assurances directly conflict with the same workflow's permission to output plaintext to a temporary file. Users handling highly sensitive data could rely on these assurances and unknowingly create persistent plaintext artifacts; this is the same underlying issue as finding-26892e5cd97e495e9a187ee283080bb2, not an independent exposure.
Content: No source excerpt is available for this finding.

L224 permits retrieval output to a plaintext temporary file, contradicting the manifest's memory-only retrieval guarantee.

High

Category: Excessive Agency
Confidence: 99% confidence
Finding: The retrieval instructions explicitly permit decrypted output to a temporary file despite promising memory-only retrieval and zero disk writes. Following those instructions could expose sensitive plaintext through filesystem access, backups, or recoverable storage remnants; clearing the file after display does not guarantee erasure.
Content: No source excerpt is available for this finding.

Several activation phrases describe general privacy needs rather than a request to scrape or retrieve web content.

Medium

Category: Trigger Abuse
Confidence: 94% confidence
Finding: Triggers such as "data minimization by design" and "local-only information gathering" apply to many activities unrelated to web scraping. Similar broad triggers appear at lines 300–305, and no exclusion limits these requests to scraping or vault retrieval.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.