Security audit

web-replication

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent website-visual-replication workflow, but it tells agents to download all discovered assets and interact with all page controls without enough safety boundaries.

Install only if you will run it in an isolated browser/profile with no saved credentials or payment data, against sites you are authorized to replicate, and with manual review or added guardrails for downloads and clicks. In particular, avoid blindly clicking forms or action buttons and restrict asset downloads to safe http/https URLs from expected hosts with size and count limits.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (3)

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.md:124
Finding: Unrestricted Activation of Untrusted Webpage Interactions
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: SKILL.md:119
Finding: Unvalidated Asset Downloads Permit Internal Requests and Resource Exhaustion
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.md:100
Finding: User-Controlled Target URL Is Shown in an Unquoted Shell Command
Content: View full analysis
agent-browser set viewport 1920 1080 agent-browser wait --load networkidle ``` ### Technical Analysis The Skill exposes a Bash-based tool and demonstrates direct insertion of the user-supplied target URL into a shell command without quoting or validation. If an implementing agent substitutes the URL text into this command verbatim, shell metacharacters can be interpreted as command syntax rather than as part of a single URL argument. Potentially significant syntax includes command separators, command substitutions, pipes, redirections, variable expansions, and whitespace that introduces additional arguments. The documented placeholder is not itself executable malicious code, but the example encourages an unsafe implementation pattern for untrusted input. Exploitation depends on the orchestration layer constructing a shell command through string interpolation. A structured tool invocation that passes the URL as a distinct argument would not be vulnerable to this path. ### Attack Path 1. A user or upstream source supplies a target value containing shell metacharacters. 2. The agent replaces the `` placeholder with the supplied value in a Bash command string. 3. The shell parses the metacharacters as operators or expansions. 4. Additional attacker-controlled commands execute with the privileges of the agent process. 5. Those commands may read or modify files, access credentials available to that process, invoke network utilities, or alter generated project content. ### Impact Assessment If exploited in a shell-interpolation implementation, commands would run with the same o ...[truncated 499 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Static analysis

No suspicious patterns detected.