T05 · Unauthorized Access and Privilege Escalation
Error
- Location
references/setup.md:13- Finding
Authenticated Daily Browser Profile Exposed Through Unrestricted CDP Automation
- Content
View full analysis
- Remediation
View remediation
Security audit
cn-browser-automation
Security checks for vulnerabilities and agentic risk
Overview
The skill openly automates logged-in Chinese websites, but it gives broad control over live Chrome sessions with arbitrary page scripting and limited guardrails.
Install only if you are comfortable letting the agent control a logged-in browser. Prefer the skill's separate Chrome profile, log in only to the target site, avoid using your daily profile, review every target URL and script before running it, and do not use it for sensitive accounts or state-changing actions unless you have explicit authorization.
Vulnerability Patterns
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)
T08 · Insecure Dependencies
Warning
- Location
references/setup.md:32- Finding
Unpinned Playwright Dependency Installed Through a Third-Party Package Mirror
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Behavioral ASTexec() Call, eval() Call, Dynamic Import
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (14)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
The declared description centers on automating Chinese websites that require authentication and reusing an already logged-in local Chrome session to preserve cookies/login state. In contrast, this code is a focused scraper for Bilibili ranking pages and explicitly describes itself as '免登录' (no login required). While it includes optional CDP connection / profile launch parameters that are consistent with browser automation infrastructure, those are supporting implementation details rather than the script's primary purpose. The main functional behavior is public-page data extraction from Bilibili rankings, which is materially different from the declared authenticated-session automation use case.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The manifest explicitly promotes reuse of an already logged-in Chrome session and cookie-backed scraping of authenticated domestic websites, but provides no warning about privacy, account takeover risk, or destructive account actions. In this context, the omission is dangerous because the skill is designed to operate with the user's live authenticated context, which can expose personal data, messages, orders, or admin panels.
- Content
Ssd 3
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
This skill is purpose-built to attach to a locally authenticated Chrome session and use existing cookies/login state to access protected resources on sites like WeChat, Taobao, Weibo, Zhihu, 12306, and SaaS admin backends. That substantially raises the risk of unauthorized data extraction and account misuse, because any accidental, ambiguous, or malicious invocation inherits the full privileges of the user's active session.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 93% confidence
- Finding
The skill explicitly describes launching Chrome, connecting over CDP, navigating authenticated sites, exporting data, and using scripts, yet it declares no tool scope or permission boundaries. That omission is dangerous because it hides powerful file-write, network, and shell behavior from reviewers and downstream policy enforcement, especially in a skill designed to reuse a real logged-in browser session and exfiltrate authenticated data.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill centers on attaching to a real, already logged-in Chrome profile and exporting data with preserved cookies/session state, but the description lacks a clear up-front warning about the sensitivity of that access. In this context, missing consent and risk language is serious because the skill can act with the user's live account privileges across sites and extract private or regulated data without an adequately explicit notice.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The trigger phrases are broad and conversational, such as requests to use a currently logged-in browser or avoid logging in again. This can cause the skill to activate in situations where the user did not explicitly intend privileged browser-session reuse, increasing the chance of unauthorized access to authenticated sites or unintended sensitive actions.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The file forces a specific language/locale for all instructions, which can violate the policy against imposing a language without user opt-in. There is no indication that users may choose another language or that the Chinese-only presentation is justified as a region-specific constraint.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
This code connects to the user's existing Chrome profile over CDP, reuses an authenticated browser context, and then executes caller-supplied JavaScript with page privileges. In this skill's context, that enables scraping or manipulating data from logged-in domestic sites using the user's live session, which can expose sensitive account data or perform authenticated actions without an explicit consent boundary or safety restriction on what JavaScript may do.
- Content
subprocess module call
Medium
- Category
- Dangerous Code Execution
- Confidence
- 70% confidence
- Finding
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
- Content
python "--no-first-run", "--no-default-browser-check", ] subprocess.Popen(cmd) for _ in range(40): if port_open(port): return
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
This code connects to a Chrome instance over CDP and intentionally reuses an authenticated browser context, then navigates to an arbitrary user-supplied URL. In the context of this skill, that means any downstream use can drive logged-in sessions on domestic sites and access account-scoped data or perform state-changing actions without an explicit consent gate or strong origin restrictions.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The --js argument is evaluated directly in the page context after attaching to an authenticated browser session, allowing arbitrary DOM interaction, data extraction, and potentially state-changing actions as the logged-in user. In this skill's context, that materially increases danger because the whole purpose is to reuse local login state for protected Chinese websites, so arbitrary script execution can automate account actions or exfiltrate private content.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
This script is explicitly designed to reuse an existing Chrome login session and export authenticated browsing results to local files, but it provides no explicit consent flow, privacy warning, or guardrails around what account-scoped data may be captured and persisted. In the context of a browser automation skill for logged-in domestic sites, this increases the chance of unintentionally collecting sensitive account data or leaving authenticated exports on disk where other local users, processes, or later workflows can access them.
- Content
Description-Behavior Mismatch
Low
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The module docstring and CLI description state that the script is for unauthenticated Bilibili ranking scraping, yet the implementation exposes CDP port selection, optional Chrome launch, and a user data directory explicitly described as preserving login state. Those behaviors align with authenticated browser-session reuse, which is broader than the script's stated '免登录' purpose.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The file's user-facing documentation and CLI messages are written in Chinese only, which imposes a specific language choice without any opt-in or alternative. This matches the policy category for language or locale constraints expressed in natural language.
- Content