Security audit

gesture-control-generator

Security checks for vulnerabilities and agentic risk

Overview

This skill is a legitimate gesture-scene generator, but its generated pages can request webcam access automatically and load remote scripts without enough upfront disclosure.

Install only if you are comfortable with generated pages using webcam-based gesture control and loading Three.js/MediaPipe code from jsDelivr. Prefer mouse-only use or edit the framework to wait for an explicit camera-enable click before calling getUserMedia, and review generated file paths before allowing creation.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (7)

Description-Behavior Mismatch

Medium

Confidence: 97% confidence
Finding: The framework automatically loads MediaPipe and then probes camera availability and attempts to start webcam-based hand tracking during initialization, without requiring an explicit user action first. That expands the skill's effective capabilities beyond its stated purpose and creates an unnecessary privacy-sensitive permission flow that could surprise users or downstream integrators.

Context-Inappropriate Capability

Medium

Confidence: 93% confidence
Finding: The code dynamically injects third-party scripts from a CDN at runtime, giving remote content influence over execution in the page context. This creates a supply-chain and integrity risk, especially because the network access is not tightly scoped or clearly disclosed by the skill's stated behavior.

Context-Inappropriate Capability

Medium

Confidence: 89% confidence
Finding: The file loads Three.js from a third-party CDN at runtime, which introduces a supply-chain and availability dependency outside the skill bundle. If the CDN content is tampered with, blocked, or unexpectedly changed, users may execute untrusted code or the scene may fail, which is unnecessary for a skill described as producing a complete HTML scene.

Missing User Warnings

Medium

Confidence: 89% confidence
Finding: The README instructs users to enable camera-based gesture control but does not disclose that webcam access is required, what data is processed, or the privacy implications before activation. In a skill that explicitly uses MediaPipe and camera input, this omission can lead users to grant sensitive device permissions without informed consent, increasing privacy and trust risks.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: The skill instructs creation of camera-enabled HTML and normalizes webcam use as a feature, but it does not prominently warn about privacy implications such as live video capture, permission prompts, and possible exposure of bystanders or sensitive surroundings. In this context, the omission is meaningful because the skill is specifically designed to generate artifacts that will request camera access in end-user browsers.

Missing User Warnings

Medium

Confidence: 84% confidence
Finding: The workflow directs the agent to copy JavaScript files and write HTML files to disk without warning the user that filesystem changes will occur. This can lead to unauthorized or surprising local modifications, especially in agentic environments where users may expect advice or code snippets rather than automatic file operations.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: Camera access is initiated automatically on startup, and the code comments/docs do not provide a clear advance explanation that webcam permission will be requested. In a skill whose description focuses on generating an HTML scene, this surprise access to a sensitive device increases privacy risk and weakens meaningful consent.

Static analysis

No suspicious patterns detected.