Security audit

Story Short Scan

Security checks across malware telemetry and agentic risk

Overview

This skill mostly supports web-fiction market research, but it also tells the agent to reuse a logged-in browser session and an admin cookie to query a private backend.

Review before installing. Use it only if you are authorized to access the Heiyan management account and are comfortable with the agent reading an admin cookie from Chrome to make backend API calls. Prefer public-page collection or a dedicated least-privilege account, and assume generated markdown files may contain private business/catalog data.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (7)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 83% confidence
Finding: The skill instructs use of browser/CDP, WebFetch, and platform page collection, which are network-capable behaviors, yet no permissions are declared. This creates an authorization and transparency gap: users and hosting systems are not clearly informed that the skill may access remote sites and collect data from logged-in sessions.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The declared purpose is public trend scanning, but the documented behavior includes extracting auth material from a logged-in browser session and querying a management backend API for booklist/details. That is materially more sensitive than scraping public rankings and can lead to unauthorized access to non-public platform data under the user's session.

Context-Inappropriate Capability

Medium

Confidence: 99% confidence
Finding: The skill explicitly directs extraction of a Bearer token from a manually logged-in Chrome session so it can call a backend API. Harvesting session-derived credentials is dangerous because it turns an interactive login into reusable API access, expanding what can be queried and increasing risk of credential misuse, privilege abuse, or leakage.

Context-Inappropriate Capability

Medium

Confidence: 94% confidence
Finding: The skill states that it can reuse the user's logged-in Chrome session to access account-gated data such as personal centers or bookshelves. Reusing an authenticated session for gated data collection exposes private account information and normalizes silent privilege borrowing beyond the skill's stated market-analysis purpose.

Description-Behavior Mismatch

Medium

Confidence: 95% confidence
Finding: The script explicitly requires manual login to a management backend and then harvests data from authenticated administrative APIs, which is materially different from scraping public popularity rankings described by the skill. This expands access to non-public business data and creates a privilege boundary violation: anyone running the skill is induced to use their own admin session to extract internal inventory data.

Context-Inappropriate Capability

High

Confidence: 99% confidence
Finding: The code reads the Admin-Token from browser cookies and reuses it as a Bearer token for backend API calls, effectively turning the user's logged-in browser session into an authentication oracle. This is dangerous because it enables collection of protected data with the user's privileges and normalizes session-token exfiltration/reuse patterns that could be adapted for broader unauthorized access.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The instructions describe extracting a Bearer token from a logged-in session without an explicit, prominent warning that the skill will access session credentials or authenticated APIs. This undermines informed consent and increases the chance that users unknowingly grant the skill backend-level access to data they did not intend to expose.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

Detected: suspicious.dangerous_exec

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: scripts/cdp-utils.js:26