Versioned security assessment
Report ID: SA-BDB71A4B
8/20/2026, 8:31:39 AM
alan-test-feature security assessment v1
Skill Security Certification Report
Scanner version 3.0.0 Audit model: codex Latest published report
- Skill name
- alan-test-feature
- Version
- v1.1.1
- Maintainer
- supatest-ai
- Coverage
- 1 Files scanned · 440 Lines analyzed
- Policy version
- skillstore-security-audit-policy-v1
Highest confirmed finding severity
High
13 confirmed security findings require attention.
Installation context
Check the current Skill page
This page summarizes report evidence only. The Skill page provides the canonical install advisory.
Open current Skill pageThis report does not block or authorize the manifest or ZIP.
Most backtick, localhost, device-file, and reconnaissance alerts are false positives caused by Markdown examples or bounded local testing. Confirmed risks include unpinned global installation, repository script execution, environment-file access, predictable temporary storage, and mandatory capture uploads. Media can contain credentials or private application data and is uploaded without a review gate.
Report position
Latest published report
Latest refers to the report sequence, not to artifact currentness.
Audit attestation
Active attestation
A public attestation is available for this exact report.
Human verification
Not verified
No human verification is recorded for this report.
Coverage
1 Files scanned · 440 Lines analyzed
29 items shown for review
Limitations
This report does not claim runtime or sandbox execution and does not prove the absence of side effects.
Evidence chain
Follow the evidence from source binding to the install contract. Available evidence supports verification; it is not a safety guarantee.
Source
Commit and path bound
Artifact
Content and tree hashes bound
Audit
Complete
Capabilities observed
Observed means this report recorded supporting evidence. Not recorded does not prove that a capability is absent.
Contains scripts
May execute code included with the Skill.
Not recorded by this audit
Network access
May connect to external services.
Observed in 5 evidence locations
Filesystem access
May read or write local files.
Observed in 18 evidence locations
Env variables
May read values from the process environment.
Not recorded by this audit
External commands
May invoke commands or programs outside the Skill.
Observed in 52 evidence locations
Capability review items (16)
High
Ruby/shell backtick execution
Analyze the current branch's changes, scope the coverage level with the user, build an explicit test
The instruction starts project processes and mandates uploading browser captures to S3. These are consequential external actions that can execute repository code and disclose application data.
High
Ruby/shell backtick execution
```bash
The fenced command installs an unpinned npm package globally and runs its installer. A compromised or changed package could execute arbitrary code with the agent's permissions.
High
Ruby/shell backtick execution
```bash
The command block starts repository-defined npm, Python, Ruby, or Docker services. Those startup paths can execute untrusted project code and alter the local environment.
High
Ruby/shell backtick execution
For each captured file, use the `mcp__alan__get_upload_url` MCP tool to get a presigned S3 URL, then
This instruction explicitly sends every captured file to S3 through a presigned URL. Captures can contain credentials, personal data, or unreleased application details.
High
Ruby/shell backtick execution
```bash
The fenced curl command performs the external PUT that uploads a local screenshot. This is a direct data-transfer action with no content review or approval gate.
Medium
Temp directory access
All captures (screenshots, videos) MUST be written to `/tmp/alan-captures/`.
The skill mandates predictable names under a shared /tmp directory without restrictive permissions or symlink checks. Captures may be exposed or redirected on multi-user systems.
Medium
Temp directory access
mkdir -p /tmp/alan-captures
The skill mandates predictable names under a shared /tmp directory without restrictive permissions or symlink checks. Captures may be exposed or redirected on multi-user systems.
Medium
Temp directory access
> - **ONLY** write capture files to `/tmp/alan-captures/`. Never anywhere else.
The skill mandates predictable names under a shared /tmp directory without restrictive permissions or symlink checks. Captures may be exposed or redirected on multi-user systems.
Medium
Temp directory access
> - If you are tempted to create a `reports/` or `screenshots/` folder anywhere other than `/tmp/`,
The skill mandates predictable names under a shared /tmp directory without restrictive permissions or symlink checks. Captures may be exposed or redirected on multi-user systems.
Medium
Temp directory access
agent-browser --session test-feature record start /tmp/alan-captures/happy-path.webm
The skill mandates predictable names under a shared /tmp directory without restrictive permissions or symlink checks. Captures may be exposed or redirected on multi-user systems.
Medium
Temp directory access
agent-browser --session test-feature screenshot /tmp/alan-captures/step-00-initial-state.png
The skill mandates predictable names under a shared /tmp directory without restrictive permissions or symlink checks. Captures may be exposed or redirected on multi-user systems.
Medium
Temp directory access
agent-browser --session test-feature screenshot /tmp/alan-captures/step-NN-description.png
The skill mandates predictable names under a shared /tmp directory without restrictive permissions or symlink checks. Captures may be exposed or redirected on multi-user systems.
Medium
Temp directory access
agent-browser --session test-feature screenshot /tmp/alan-captures/final-state.png
The skill mandates predictable names under a shared /tmp directory without restrictive permissions or symlink checks. Captures may be exposed or redirected on multi-user systems.
Medium
Temp directory access
for f in /tmp/alan-captures/*.webm; do
The skill mandates predictable names under a shared /tmp directory without restrictive permissions or symlink checks. Captures may be exposed or redirected on multi-user systems.
Medium
Temp directory access
SIZE=$(stat -c%s "/tmp/alan-captures/step-01.png" 2>/dev/null || stat -f%z "/tmp/alan-captures/step-
The skill mandates predictable names under a shared /tmp directory without restrictive permissions or symlink checks. Captures may be exposed or redirected on multi-user systems.
Medium
Temp directory access
--data-binary @/tmp/alan-captures/step-01.png
The skill mandates predictable names under a shared /tmp directory without restrictive permissions or symlink checks. Captures may be exposed or redirected on multi-user systems.
Risk findings
Confirmed security concerns are separated from items that still need review.
Confirmed security concerns (13)
RISK-001 High
Environment file access
4. Check for `Procfile`, `.env`, `Pipfile`, `requirements.txt`, `Gemfile`
The discovery step includes checking .env while determining how to run the project. It may expose unrelated credentials even though the exact read method is not specified.
RISK-002 High
Environment file access
- Check `.env` or `.env.local` for `PORT` or `VITE_PORT` or similar
The skill explicitly directs the agent to inspect .env and .env.local. These files commonly contain credentials beyond the requested port value.
RISK-003 High
Environment variant files
- Check `.env` or `.env.local` for `PORT` or `VITE_PORT` or similar
The skill explicitly directs the agent to inspect .env and .env.local. These files commonly contain credentials beyond the requested port value.
RISK-004 High
Screen capture upload
description: Scope coverage, build a testing strategy, test the feature with agent-browser, capture
The workflow requires captured application screens to be uploaded and referenced from a persistent report. Sensitive UI data can leave the local environment without a review gate.
RISK-005 High
Screen capture upload
Analyze the current branch's changes, scope the coverage level with the user, build an explicit test
The workflow requires captured application screens to be uploaded and referenced from a persistent report. Sensitive UI data can leave the local environment without a review gate.
RISK-006 High
Screen capture upload
All captures (screenshots, videos) MUST be written to `/tmp/alan-captures/`.
This mandatory capture is part of the workflow that uploads every screenshot and video to S3. The image may contain credentials, personal data, or private application state.
RISK-007 High
Screen capture upload
> - If you are tempted to create a `reports/` or `screenshots/` folder anywhere other than `/tmp/`,
This mandatory capture is part of the workflow that uploads every screenshot and video to S3. The image may contain credentials, personal data, or private application state.
RISK-008 High
Screen capture upload
agent-browser --session test-feature screenshot /tmp/alan-captures/step-00-initial-state.png
This mandatory capture is part of the workflow that uploads every screenshot and video to S3. The image may contain credentials, personal data, or private application state.
RISK-009 High
Screen capture upload
agent-browser --session test-feature screenshot /tmp/alan-captures/step-NN-description.png
This mandatory capture is part of the workflow that uploads every screenshot and video to S3. The image may contain credentials, personal data, or private application state.
RISK-010 High
Screen capture upload
agent-browser --session test-feature screenshot /tmp/alan-captures/final-state.png
This mandatory capture is part of the workflow that uploads every screenshot and video to S3. The image may contain credentials, personal data, or private application state.
RISK-011 High
Screen capture upload
"screenshotUrl": "<s3Key from Phase 3 — e.g. sandbox-captures/org/task/step-01.png — omit if upload
The workflow requires captured application screens to be uploaded and referenced from a persistent report. Sensitive UI data can leave the local environment without a review gate.
RISK-012 High
Screen capture upload
"screenshotUrl": "<s3Key from Phase 3 showing the issue — omit if upload failed>"
The workflow requires captured application screens to be uploaded and referenced from a persistent report. Sensitive UI data can leave the local environment without a review gate.
RISK-013 High
Screen capture upload
- **screenshotUrls**: flat list of ALL screenshot s3Keys from Phase 3 (for gallery display). Use the
The workflow requires captured application screens to be uploaded and referenced from a persistent report. Sensitive UI data can leave the local environment without a review gate.
Remediation
Suggested fixes recorded by this audit. Applying them is the maintainer’s responsibility.
- FIX-001HighMandatory screenshot and video uploads can disclose sensitive application data.Require explicit approval before upload, preview every capture, redact secrets and personal data, and support a local-only report mode.
- FIX-002HighThe workflow reads .env and .env.local while discovering the application port.Prefer server output and public configuration. If needed, parse only allowlisted port keys without exposing complete environment files.
- FIX-003HighThe skill globally installs an unpinned npm package.Pin an audited agent-browser version, verify package integrity, and require user confirmation before installation.
- FIX-004HighThe skill starts repository-defined scripts and services.Show the resolved command, inspect its definition, and request confirmation before executing project startup code.
- FIX-005MediumCapture files use predictable paths in a shared temporary directory.Create a private temporary directory with restrictive permissions, reject symlinks, and remove captures after reporting.
Expert evidence
Immutable subject identity, scanner metadata, dismissed matches, and source-level evidence.
Artifact subject
- Marketplace commit
- bdb71a4bc34515f37772ae85fd5501f9c2ff33b0
- Content hash
- a8ce601a33ab9116f6f9c850a848348691a47520fc861ee13e42bb6c971cf5eb
- Tree hash
- 39483f20f806023bc7b3e35aee74f4858ca295272e65c42797c063e4349a8c1e
- Skill path
- skills/supatest-ai/alan-test-feature
- Audit payload hash
- 58d698b4f3ec270ec74c32b80d9d0a62
Analysis metadata
Audit model: codex
Analysis state: Complete
Scope is limited to the recorded files, lines, methods, and evidence. No runtime or sandbox execution is claimed.
Verify and export
The manifest and lockfile bind install artifacts to cryptographic hashes. This integrity claim is separate from the security assessment.
Audit attestation: active