{ "skill_name": "agent-browser", "skill_path": "/Users/brianlevine/claude-projects/skill-scanner-test/skills/101-skills-superpowers/tools/utilities/agent-browser", "is_safe": false, "max_severity": "HIGH", "findings_count": 10, "findings": [ { "id": "ALLOWED_TOOLS_BASH_VIOLATION_43e797a9ce", "rule_id": "ALLOWED_TOOLS_BASH_VIOLATION", "category": "unauthorized_tool_use", "severity": "HIGH", "title": "Code executes bash but Bash tool not in allowed-tools", "description": "Skill restricts tools to ['Bash(belt', '*)'] but code executes bash commands", "file_path": "SKILL.md", "line_number": null, "snippet": null, "remediation": "Add 'Bash' to allowed-tools or remove bash execution from code", "analyzer": "static", "metadata": { "semantic_facts": { "evidence_kind": "capability_mismatch", "context_kind": "manifest", "signals": [ { "rule_id": "ALLOWED_TOOLS_BASH_VIOLATION", "kind": "undeclared_tool", "file_path": "SKILL.md", "value_class": "bash" } ], "candidate_command": { "executable": "Bash", "argument_classes": [], "downloads": false, "executes": true, "destructive": false, "privilege_change": false, "source_class": "skill_code", "sink_class": "process_execution", "file_path": "" }, "commands": [ { "executable": "Bash", "argument_classes": [], "downloads": false, "executes": true, "destructive": false, "privilege_change": false, "source_class": "skill_code", "sink_class": "process_execution", "file_path": "" } ] }, "aitech": "AITech-2.1", "aitech_name": "Excessive Agency", "aisubtech": "AISubtech-2.1.2", "aisubtech_name": "Capability and Permission Overreach", "aitech_mappings": [ "OWASP: LLM03:2026: Excessive Agency", "OWASP: ASI10: Rogue Agents", "MITRE ATLAS: N/A", "NIST AML: N/A" ], "aisubtech_mappings": [ "OWASP: LLM03:2026: Excessive Agency", "OWASP: ASI10: Rogue Agents", "MITRE ATLAS: N/A", "NIST AML: N/A" ], "framework_mappings": [ "OWASP: LLM03:2026: Excessive Agency", "OWASP: ASI10: Rogue Agents", "MITRE ATLAS: N/A", "NIST AML: N/A" ], "taxonomy_status": "mapped", "taxonomy_source": "rule" } }, { "id": "ALLOWED_TOOLS_GREP_VIOLATION_9aeea76eee", "rule_id": "ALLOWED_TOOLS_GREP_VIOLATION", "category": "unauthorized_tool_use", "severity": "LOW", "title": "Code uses search/grep patterns but Grep tool not in allowed-tools", "description": "Skill restricts tools to ['Bash(belt', '*)'] but code uses regex search patterns", "file_path": "SKILL.md", "line_number": null, "snippet": null, "remediation": "Add 'Grep' to allowed-tools or remove regex search operations", "analyzer": "static", "metadata": { "semantic_facts": { "evidence_kind": "capability_mismatch", "context_kind": "manifest", "signals": [ { "rule_id": "ALLOWED_TOOLS_GREP_VIOLATION", "kind": "undeclared_tool", "file_path": "SKILL.md", "value_class": "grep" } ], "candidate_command": { "executable": "Grep", "argument_classes": [], "downloads": false, "executes": false, "destructive": false, "privilege_change": false, "source_class": "skill_code", "sink_class": "content_search", "file_path": "" }, "commands": [ { "executable": "Grep", "argument_classes": [], "downloads": false, "executes": false, "destructive": false, "privilege_change": false, "source_class": "skill_code", "sink_class": "content_search", "file_path": "" } ] }, "aitech": "AITech-2.1", "aitech_name": "Excessive Agency", "aisubtech": "AISubtech-2.1.2", "aisubtech_name": "Capability and Permission Overreach", "aitech_mappings": [ "OWASP: LLM03:2026: Excessive Agency", "OWASP: ASI10: Rogue Agents", "MITRE ATLAS: N/A", "NIST AML: N/A" ], "aisubtech_mappings": [ "OWASP: LLM03:2026: Excessive Agency", "OWASP: ASI10: Rogue Agents", "MITRE ATLAS: N/A", "NIST AML: N/A" ], "framework_mappings": [ "OWASP: LLM03:2026: Excessive Agency", "OWASP: ASI10: Rogue Agents", "MITRE ATLAS: N/A", "NIST AML: N/A" ], "taxonomy_status": "mapped", "taxonomy_source": "rule" } }, { "id": "MANIFEST_MISSING_LICENSE_c5ae9be793", "rule_id": "MANIFEST_MISSING_LICENSE", "category": "policy_violation", "severity": "INFO", "title": "Skill does not specify a license", "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.", "file_path": "SKILL.md", "line_number": null, "snippet": null, "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)", "analyzer": "static", "metadata": { "aitech": null, "aitech_name": null, "aisubtech": null, "aisubtech_name": null, "aitech_mappings": [], "aisubtech_mappings": [], "framework_mappings": [], "taxonomy_status": "not_applicable", "taxonomy_source": "rule" } }, { "id": "BASH_TAINT_17683bf6e6", "rule_id": "BEHAVIOR_BASH_TAINT_FLOW", "category": "data_exfiltration", "severity": "MEDIUM", "title": "Bash: tainted data flows to dangerous sink", "description": "Variable $SESSION_ID (line 60) flows to `sh` at line 76.", "file_path": "templates/capture-workflow.sh", "line_number": 76, "snippet": "infsh app run agent-browser --function interact --session $SESSION_ID --input '{", "remediation": "Review the data flow from source to sink. Avoid sending sensitive or untrusted data to network or execution commands.", "analyzer": "behavioral", "metadata": { "source_var": "SESSION_ID", "source_line": 60, "sink_command": "sh", "taints": [ "COMMAND_OUTPUT" ], "behavior_category": "command_injection", "aitech": "AITech-8.2", "aitech_name": "Data Exfiltration / Exposure", "aisubtech": "AISubtech-8.2.3", "aisubtech_name": "Data Exfiltration via Agent Tooling", "aitech_mappings": [ "OWASP: LLM02:2026: Sensitive Information Disclosure", "OWASP: ASI09: Human-Agent Trust Exploitation", "MITRE ATLAS: AML.T0024.000: Exfiltration via AI Inference API: Infer Training Data Membership", "MITRE ATLAS: AML.T0035: AI Artifact Collection", "MITRE ATLAS: AML.T0037: Data From Local System", "MITRE ATLAS: AML.T0057: LLM Data Leakage", "NIST AML: NISTAML.037: Training Data Attacks" ], "aisubtech_mappings": [ "OWASP: LLM02:2026: Sensitive Information Disclosure", "OWASP: ASI02: Tool Misuse & Exploitation", "OWASP: ASI09: Human-Agent Trust Exploitation", "MITRE ATLAS: AML.T0086: Exfiltration via AI Agent Tool Invocation", "NIST AML: N/A" ], "framework_mappings": [ "OWASP: LLM02:2026: Sensitive Information Disclosure", "OWASP: ASI02: Tool Misuse & Exploitation", "OWASP: ASI09: Human-Agent Trust Exploitation", "MITRE ATLAS: AML.T0086: Exfiltration via AI Agent Tool Invocation", "NIST AML: N/A" ], "taxonomy_status": "mapped", "taxonomy_source": "rule" } }, { "id": "BASH_TAINT_3b8428f65e", "rule_id": "BEHAVIOR_BASH_TAINT_FLOW", "category": "data_exfiltration", "severity": "MEDIUM", "title": "Bash: tainted data flows to dangerous sink", "description": "Variable $SESSION_ID (line 60) flows to `sh` at line 79.", "file_path": "templates/capture-workflow.sh", "line_number": 79, "snippet": "infsh app run agent-browser --function interact --session $SESSION_ID --input '{", "remediation": "Review the data flow from source to sink. Avoid sending sensitive or untrusted data to network or execution commands.", "analyzer": "behavioral", "metadata": { "source_var": "SESSION_ID", "source_line": 60, "sink_command": "sh", "taints": [ "COMMAND_OUTPUT" ], "behavior_category": "command_injection", "aitech": "AITech-8.2", "aitech_name": "Data Exfiltration / Exposure", "aisubtech": "AISubtech-8.2.3", "aisubtech_name": "Data Exfiltration via Agent Tooling", "aitech_mappings": [ "OWASP: LLM02:2026: Sensitive Information Disclosure", "OWASP: ASI09: Human-Agent Trust Exploitation", "MITRE ATLAS: AML.T0024.000: Exfiltration via AI Inference API: Infer Training Data Membership", "MITRE ATLAS: AML.T0035: AI Artifact Collection", "MITRE ATLAS: AML.T0037: Data From Local System", "MITRE ATLAS: AML.T0057: LLM Data Leakage", "NIST AML: NISTAML.037: Training Data Attacks" ], "aisubtech_mappings": [ "OWASP: LLM02:2026: Sensitive Information Disclosure", "OWASP: ASI02: Tool Misuse & Exploitation", "OWASP: ASI09: Human-Agent Trust Exploitation", "MITRE ATLAS: AML.T0086: Exfiltration via AI Agent Tool Invocation", "NIST AML: N/A" ], "framework_mappings": [ "OWASP: LLM02:2026: Sensitive Information Disclosure", "OWASP: ASI02: Tool Misuse & Exploitation", "OWASP: ASI09: Human-Agent Trust Exploitation", "MITRE ATLAS: AML.T0086: Exfiltration via AI Agent Tool Invocation", "NIST AML: N/A" ], "taxonomy_status": "mapped", "taxonomy_source": "rule" } }, { "id": "BASH_TAINT_cfe0c8bdba", "rule_id": "BEHAVIOR_BASH_TAINT_FLOW", "category": "data_exfiltration", "severity": "MEDIUM", "title": "Bash: tainted data flows to dangerous sink", "description": "Variable $SESSION_ID (line 60) flows to `sh` at line 86.", "file_path": "templates/capture-workflow.sh", "line_number": 86, "snippet": "RESULT=$(infsh app run agent-browser --function snapshot --session $SESSION_ID --input '{}')", "remediation": "Review the data flow from source to sink. Avoid sending sensitive or untrusted data to network or execution commands.", "analyzer": "behavioral", "metadata": { "source_var": "SESSION_ID", "source_line": 60, "sink_command": "sh", "taints": [ "COMMAND_OUTPUT" ], "behavior_category": "command_injection", "aitech": "AITech-8.2", "aitech_name": "Data Exfiltration / Exposure", "aisubtech": "AISubtech-8.2.3", "aisubtech_name": "Data Exfiltration via Agent Tooling", "aitech_mappings": [ "OWASP: LLM02:2026: Sensitive Information Disclosure", "OWASP: ASI09: Human-Agent Trust Exploitation", "MITRE ATLAS: AML.T0024.000: Exfiltration via AI Inference API: Infer Training Data Membership", "MITRE ATLAS: AML.T0035: AI Artifact Collection", "MITRE ATLAS: AML.T0037: Data From Local System", "MITRE ATLAS: AML.T0057: LLM Data Leakage", "NIST AML: NISTAML.037: Training Data Attacks" ], "aisubtech_mappings": [ "OWASP: LLM02:2026: Sensitive Information Disclosure", "OWASP: ASI02: Tool Misuse & Exploitation", "OWASP: ASI09: Human-Agent Trust Exploitation", "MITRE ATLAS: AML.T0086: Exfiltration via AI Agent Tool Invocation", "NIST AML: N/A" ], "framework_mappings": [ "OWASP: LLM02:2026: Sensitive Information Disclosure", "OWASP: ASI02: Tool Misuse & Exploitation", "OWASP: ASI09: Human-Agent Trust Exploitation", "MITRE ATLAS: AML.T0086: Exfiltration via AI Agent Tool Invocation", "NIST AML: N/A" ], "taxonomy_status": "mapped", "taxonomy_source": "rule" } }, { "id": "BASH_TAINT_088867ba29", "rule_id": "BEHAVIOR_BASH_TAINT_FLOW", "category": "data_exfiltration", "severity": "MEDIUM", "title": "Bash: tainted data flows to dangerous sink", "description": "Variable $SESSION_ID (line 60) flows to `sh` at line 91.", "file_path": "templates/capture-workflow.sh", "line_number": 91, "snippet": "infsh app run agent-browser --function screenshot --session $SESSION_ID --input '{}' > \"$OUTPUT_DIR/page-screenshot.json\"", "remediation": "Review the data flow from source to sink. Avoid sending sensitive or untrusted data to network or execution commands.", "analyzer": "behavioral", "metadata": { "source_var": "SESSION_ID", "source_line": 60, "sink_command": "sh", "taints": [ "COMMAND_OUTPUT" ], "behavior_category": "command_injection", "aitech": "AITech-8.2", "aitech_name": "Data Exfiltration / Exposure", "aisubtech": "AISubtech-8.2.3", "aisubtech_name": "Data Exfiltration via Agent Tooling", "aitech_mappings": [ "OWASP: LLM02:2026: Sensitive Information Disclosure", "OWASP: ASI09: Human-Agent Trust Exploitation", "MITRE ATLAS: AML.T0024.000: Exfiltration via AI Inference API: Infer Training Data Membership", "MITRE ATLAS: AML.T0035: AI Artifact Collection", "MITRE ATLAS: AML.T0037: Data From Local System", "MITRE ATLAS: AML.T0057: LLM Data Leakage", "NIST AML: NISTAML.037: Training Data Attacks" ], "aisubtech_mappings": [ "OWASP: LLM02:2026: Sensitive Information Disclosure", "OWASP: ASI02: Tool Misuse & Exploitation", "OWASP: ASI09: Human-Agent Trust Exploitation", "MITRE ATLAS: AML.T0086: Exfiltration via AI Agent Tool Invocation", "NIST AML: N/A" ], "framework_mappings": [ "OWASP: LLM02:2026: Sensitive Information Disclosure", "OWASP: ASI02: Tool Misuse & Exploitation", "OWASP: ASI09: Human-Agent Trust Exploitation", "MITRE ATLAS: AML.T0086: Exfiltration via AI Agent Tool Invocation", "NIST AML: N/A" ], "taxonomy_status": "mapped", "taxonomy_source": "rule" } }, { "id": "BASH_TAINT_b43123b057", "rule_id": "BEHAVIOR_BASH_TAINT_FLOW", "category": "data_exfiltration", "severity": "MEDIUM", "title": "Bash: tainted data flows to dangerous sink", "description": "Variable $SESSION_ID (line 60) flows to `sh` at line 97.", "file_path": "templates/capture-workflow.sh", "line_number": 97, "snippet": "infsh app run agent-browser --function screenshot --session $SESSION_ID --input '{", "remediation": "Review the data flow from source to sink. Avoid sending sensitive or untrusted data to network or execution commands.", "analyzer": "behavioral", "metadata": { "source_var": "SESSION_ID", "source_line": 60, "sink_command": "sh", "taints": [ "COMMAND_OUTPUT" ], "behavior_category": "command_injection", "aitech": "AITech-8.2", "aitech_name": "Data Exfiltration / Exposure", "aisubtech": "AISubtech-8.2.3", "aisubtech_name": "Data Exfiltration via Agent Tooling", "aitech_mappings": [ "OWASP: LLM02:2026: Sensitive Information Disclosure", "OWASP: ASI09: Human-Agent Trust Exploitation", "MITRE ATLAS: AML.T0024.000: Exfiltration via AI Inference API: Infer Training Data Membership", "MITRE ATLAS: AML.T0035: AI Artifact Collection", "MITRE ATLAS: AML.T0037: Data From Local System", "MITRE ATLAS: AML.T0057: LLM Data Leakage", "NIST AML: NISTAML.037: Training Data Attacks" ], "aisubtech_mappings": [ "OWASP: LLM02:2026: Sensitive Information Disclosure", "OWASP: ASI02: Tool Misuse & Exploitation", "OWASP: ASI09: Human-Agent Trust Exploitation", "MITRE ATLAS: AML.T0086: Exfiltration via AI Agent Tool Invocation", "NIST AML: N/A" ], "framework_mappings": [ "OWASP: LLM02:2026: Sensitive Information Disclosure", "OWASP: ASI02: Tool Misuse & Exploitation", "OWASP: ASI09: Human-Agent Trust Exploitation", "MITRE ATLAS: AML.T0086: Exfiltration via AI Agent Tool Invocation", "NIST AML: N/A" ], "taxonomy_status": "mapped", "taxonomy_source": "rule" } }, { "id": "BASH_TAINT_6b0d256c69", "rule_id": "BEHAVIOR_BASH_TAINT_FLOW", "category": "data_exfiltration", "severity": "MEDIUM", "title": "Bash: tainted data flows to dangerous sink", "description": "Variable $SESSION_ID (line 60) flows to `sh` at line 105.", "file_path": "templates/capture-workflow.sh", "line_number": 105, "snippet": "RESULT=$(infsh app run agent-browser --function execute --session $SESSION_ID --input '{", "remediation": "Review the data flow from source to sink. Avoid sending sensitive or untrusted data to network or execution commands.", "analyzer": "behavioral", "metadata": { "source_var": "SESSION_ID", "source_line": 60, "sink_command": "sh", "taints": [ "COMMAND_OUTPUT" ], "behavior_category": "command_injection", "aitech": "AITech-8.2", "aitech_name": "Data Exfiltration / Exposure", "aisubtech": "AISubtech-8.2.3", "aisubtech_name": "Data Exfiltration via Agent Tooling", "aitech_mappings": [ "OWASP: LLM02:2026: Sensitive Information Disclosure", "OWASP: ASI09: Human-Agent Trust Exploitation", "MITRE ATLAS: AML.T0024.000: Exfiltration via AI Inference API: Infer Training Data Membership", "MITRE ATLAS: AML.T0035: AI Artifact Collection", "MITRE ATLAS: AML.T0037: Data From Local System", "MITRE ATLAS: AML.T0057: LLM Data Leakage", "NIST AML: NISTAML.037: Training Data Attacks" ], "aisubtech_mappings": [ "OWASP: LLM02:2026: Sensitive Information Disclosure", "OWASP: ASI02: Tool Misuse & Exploitation", "OWASP: ASI09: Human-Agent Trust Exploitation", "MITRE ATLAS: AML.T0086: Exfiltration via AI Agent Tool Invocation", "NIST AML: N/A" ], "framework_mappings": [ "OWASP: LLM02:2026: Sensitive Information Disclosure", "OWASP: ASI02: Tool Misuse & Exploitation", "OWASP: ASI09: Human-Agent Trust Exploitation", "MITRE ATLAS: AML.T0086: Exfiltration via AI Agent Tool Invocation", "NIST AML: N/A" ], "taxonomy_status": "mapped", "taxonomy_source": "rule" } }, { "id": "BASH_TAINT_7d0b654603", "rule_id": "BEHAVIOR_BASH_TAINT_FLOW", "category": "data_exfiltration", "severity": "MEDIUM", "title": "Bash: tainted data flows to dangerous sink", "description": "Variable $SESSION_ID (line 60) flows to `sh` at line 114.", "file_path": "templates/capture-workflow.sh", "line_number": 114, "snippet": "RESULT=$(infsh app run agent-browser --function execute --session $SESSION_ID --input '{", "remediation": "Review the data flow from source to sink. Avoid sending sensitive or untrusted data to network or execution commands.", "analyzer": "behavioral", "metadata": { "source_var": "SESSION_ID", "source_line": 60, "sink_command": "sh", "taints": [ "COMMAND_OUTPUT" ], "behavior_category": "command_injection", "aitech": "AITech-8.2", "aitech_name": "Data Exfiltration / Exposure", "aisubtech": "AISubtech-8.2.3", "aisubtech_name": "Data Exfiltration via Agent Tooling", "aitech_mappings": [ "OWASP: LLM02:2026: Sensitive Information Disclosure", "OWASP: ASI09: Human-Agent Trust Exploitation", "MITRE ATLAS: AML.T0024.000: Exfiltration via AI Inference API: Infer Training Data Membership", "MITRE ATLAS: AML.T0035: AI Artifact Collection", "MITRE ATLAS: AML.T0037: Data From Local System", "MITRE ATLAS: AML.T0057: LLM Data Leakage", "NIST AML: NISTAML.037: Training Data Attacks" ], "aisubtech_mappings": [ "OWASP: LLM02:2026: Sensitive Information Disclosure", "OWASP: ASI02: Tool Misuse & Exploitation", "OWASP: ASI09: Human-Agent Trust Exploitation", "MITRE ATLAS: AML.T0086: Exfiltration via AI Agent Tool Invocation", "NIST AML: N/A" ], "framework_mappings": [ "OWASP: LLM02:2026: Sensitive Information Disclosure", "OWASP: ASI02: Tool Misuse & Exploitation", "OWASP: ASI09: Human-Agent Trust Exploitation", "MITRE ATLAS: AML.T0086: Exfiltration via AI Agent Tool Invocation", "NIST AML: N/A" ], "taxonomy_status": "mapped", "taxonomy_source": "rule" } } ], "scan_duration_seconds": 0.07898187637329102, "duration_ms": 78, "analyzers_used": [ "static_analyzer", "bytecode", "pipeline", "correlation", "behavioral_analyzer", "trigger_analyzer" ], "timestamp": "2026-10-22T04:35:34.409433+00:00", "scan_metadata": { "policy_name": "default", "policy_version": "1.0", "policy_preset_base": "balanced", "policy_fingerprint_sha256": "3f48e661bfbc54597f97bbf3dcf2c1cbae2f596ddc79c0b44784efea326b3d1d", "cel": { "mode": "shadow", "runtime": "cel-go", "runtime_version": "v0.32.0;helper=2.3.1", "fact_schema": "v1", "expression_set_hash": "f26459b8f4a46a974d7ab0aaae34127b5b6a40d693e266e12fca03a69a6d26aa", "evaluated": 0, "retained": 10, "would_suppress": 0, "suppressed": 0, "fallbacks": 0, "projection_incomplete": 0, "elapsed_ms": 0.0, "projection_ms": 0.0, "evaluation_ms": 0.0, "errors": [], "per_rule": {}, "suppressed_candidates": [] }, "rule_contract": { "status": "passed", "schema_version": 2, "checked": 10, "invalid_findings": 0, "errors": [] }, "taxonomy": { "source": "builtin", "version": "2.0.0", "name": "Cisco AI Security and Safety Taxonomy", "revision": "655a343ac943a51b6f61f86e47156e7752c15dc6", "snapshot_sha256": "413e8ce9081e6d91b78aaa0d0b1c06cdc15d0406ad319e23e9f9f4f80735c441", "findings": { "mapped": 9, "not_applicable": 1, "unmapped": 0 } } }, "scanner_version": "2.3.1", "source": "101-skills", "repo_url": "https://github.com/101-skills/superpowers" }