Lp3
Medium
- Category
- MCP Least Privilege
- Confidence
- 70% confidence
- Finding
- Without declared permissions the skill's intent is opaque and cannot be validated.
Security audit
browser-session-curator
Security checks for vulnerabilities and agentic risk
Overview
This skill organizes user-provided browser tabs and bookmarks into a local digest without hidden networking, credential use, or persistence.
Installers should expect a lightweight local organizer for tab and bookmark material. Provide only the tab data you want organized, review the generated digest before acting on it, and choose an output path carefully because the helper script can write or overwrite a JSON digest file when invoked.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Vulnerability Patterns
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (8)
Vague Triggers
Medium
- Confidence
- 90% confidence
- Finding
- The trigger phrase is very broad and can match ordinary user requests about organizing tabs, causing the skill to activate outside clearly intended contexts. Over-broad invocation language increases the chance of accidental routing, which can lead to inappropriate use of the skill workflow or unexpected handling of user content.
Vague Triggers
Medium
- Confidence
- 88% confidence
- Finding
- The phrase '书签归档' is ambiguous because it could refer to many generic bookmark-management tasks rather than this specific skill. This ambiguity can cause accidental invocation overlap with unrelated skills or normal assistant behavior, reducing predictability and increasing the attack surface for prompt-routing mistakes.
Vague Triggers
Medium
- Confidence
- 90% confidence
- Finding
- This trigger phrase broadly describes a common user intent and does not define clear boundaries for invoking the skill. Such vague routing criteria can cause the skill to intercept ordinary browser-organization requests, creating confusion and increasing the risk of incorrect workflow selection.
Natural-Language Policy Violations
Medium
- Confidence
- 95% confidence
- Finding
- This markdown file contains operational instructions entirely in Chinese, including section headings and validation steps. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale restriction is explicitly justified, which is not present here.
Natural-Language Policy Violations
Low
- Confidence
- 87% confidence
- Finding
- The file presents core usage information in a mixed-language format, including Chinese section headings and bullets alongside English content. Per the policy rule, forcing or assuming a language/locale without user opt-in can be a natural-language policy issue when no justification or language choice is provided.
Natural-Language Policy Violations
Low
- Confidence
- 88% confidence
- Finding
- The trigger phrase list includes Chinese-only invocations alongside English ones, but the document does not explain language selection or state that users may choose their preferred language. This can create a locale-policy issue because the skill appears to prescribe specific languages for activation without explicit opt-in or flexibility guidance.
Vague Triggers
Low
- Confidence
- 84% confidence
- Finding
- This YAML manifest contains generic labels such as "action," "reading," "buy," and "reply" without any description of scope, activation context, or exclusion conditions. Because the tags overlap with common everyday concepts and provide no limiting guidance, they could contribute to ambiguous or overly broad skill invocation or classification behavior.
Static analysis
No suspicious patterns detected.