Security audit

kurobbs-wiki

Security checks across malware telemetry and agentic risk

Overview

This game wiki helper has useful disclosed features, but it needs Review because it bypasses site protections, downloads/processes media, and stores account login data locally in plaintext.

Install only if you are comfortable with a skill that can automate a browser against kurobbs, download public post media, invoke ffmpeg, and cache your kurobbs phone/token/character data locally. Prefer using public wiki commands without login, and delete ~/.kurobbs-wiki-cache/account.json when you no longer need account features.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (29)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 94% confidence
Finding: The skill advertises broad operational behavior that clearly uses shell execution, network access, local file reads/writes, and browser automation, yet no explicit permissions are declared. This weakens least-privilege enforcement and informed consent, making it easier for an agent platform to grant overly broad capabilities implicitly.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: The manifest frames the skill as a wiki/account query helper, but the documentation expands into WAF-bypassing scraping, local media downloading, ffmpeg video processing, OCR delegation, and analytics workflows. This description-behavior mismatch is dangerous because users and hosting agents may authorize the skill under a narrower trust model than what it actually performs.

Context-Inappropriate Capability

Medium

Confidence: 95% confidence
Finding: The README advertises a `post` capability that explicitly bypasses a WAF to fetch community media, which exceeds the stated purpose of wiki lookup and own-account character inspection. WAF-bypass functionality is a strong indicator of anti-access-control behavior and could be used to retrieve protected or rate-limited content in ways the service operator did not intend.

Context-Inappropriate Capability

Medium

Confidence: 82% confidence
Finding: Documenting ffmpeg-based m3u8 downloading adds a bulk media acquisition capability unrelated to the core wiki/account-role use case. While not inherently malicious alone, in this context it broadens the skill into scraping/downloading community video content and increases abuse potential, especially combined with the documented WAF bypass.

Intent-Code Divergence

Medium

Confidence: 88% confidence
Finding: The privacy statement is misleading because login, token renewal, and account-data retrieval necessarily transmit credentials/session artifacts and account information to kurobbs servers. Saying data is 'never uploaded to any server' can cause users to underestimate privacy and account-security risks during authentication and sync operations.

Description-Behavior Mismatch

Medium

Confidence: 94% confidence
Finding: The README documents a `post` capability that scrapes community-post media and explicitly mentions bypassing WAF protections, which extends beyond the declared wiki-query/account-role scope. Hidden or under-declared functionality reduces transparency for users and hosts, and a WAF-bypass feature can facilitate access patterns the platform is intentionally trying to restrict.

Description-Behavior Mismatch

Medium

Confidence: 97% confidence
Finding: The documented directory structure and feature list advertise browser-based media extraction with Playwright to bypass WAF, contradicting the description that functionality is achieved via public JSON APIs. This mismatch is dangerous because reviewers and users may grant trust based on a narrower stated capability while the skill includes broader scraping behavior that could expose the host to policy, legal, or abuse risks.

Intent-Code Divergence

Low

Confidence: 84% confidence
Finding: The privacy statement says account data 'will not be uploaded to any server,' but the login and token-renew flow necessarily transmits credentials, tokens, and account-related requests to kurobbs servers. This is primarily a transparency and consent issue: users could misunderstand the network exposure of their data during authentication and account syncing.

Description-Behavior Mismatch

Medium

Confidence: 93% confidence
Finding: The workflow explicitly instructs the agent to automatically download images/videos to local temporary directories and process them, even when the user only asked for content summaries. Unprompted filesystem writes and media handling enlarge the attack surface, create privacy and storage risks, and normalize agent-side content acquisition beyond the original request.

Description-Behavior Mismatch

Medium

Confidence: 96% confidence
Finding: The skill claims its operations are performed through public JSON APIs, but the same document directs use of Playwright to bypass WAF protections and scrape post media. Instructing an agent to circumvent access controls materially increases risk and crosses from ordinary API usage into evasive browser automation.

Description-Behavior Mismatch

Medium

Confidence: 89% confidence
Finding: The documented ffmpeg-based m3u8 download path adds executable tooling and potentially large local media handling that is not reflected in the stated purpose. While likely intended to help users inspect guide videos, it meaningfully increases operational risk, resource usage, and opportunities for misuse compared with simple wiki querying.

Context-Inappropriate Capability

Medium

Confidence: 88% confidence
Finding: The skill recommends sending downloaded media to external recognition scripts or OCR services when native vision is unavailable. This can exfiltrate user-requested content or account-adjacent material to third parties without a strong trust boundary or explicit consent.

Description-Behavior Mismatch

Medium

Confidence: 93% confidence
Finding: The login flow persists far more than is needed for the advertised 'my roles'/'my team' use case: phone number, long-lived token, device identifiers, bound roles, full role list, and per-character detailed data. This creates unnecessary retention of sensitive account data and broadens the blast radius if the local file is read by another process, user, or later skill action.

Description-Behavior Mismatch

Medium

Confidence: 96% confidence
Finding: The script defines a persistent cache directory and account file in the user's home directory, extending behavior beyond a one-time browser login for role lookup. Persisting account state and tokens without clear declaration increases exposure duration and enables later reuse of authentication material outside the narrow user action.

Description-Behavior Mismatch

Medium

Confidence: 89% confidence
Finding: The script can download and persist remote media locally, which exceeds the described skill purpose of WIKI lookup and account-role viewing. This broadens the skill from read/query behavior into filesystem-writing and content acquisition, increasing abuse potential and violating least privilege.

Context-Inappropriate Capability

High

Confidence: 93% confidence
Finding: Invoking ffmpeg on attacker-controlled remote media URLs gives the skill an unnecessary native-code processing capability unrelated to WIKI lookup. ffmpeg has a long history of parser and protocol-surface bugs, so feeding it untrusted m3u8/media inputs can increase the risk of SSRF-like network access, unexpected protocol handling, or exploitation of the local environment.

Description-Behavior Mismatch

Medium

Confidence: 91% confidence
Finding: The code uses browser automation and response interception specifically to bypass a WAF-protected API path, which is outside the stated public JSON API lookup model. This introduces hidden network behavior and anti-protection circumvention that makes the skill materially more dangerous and harder to audit.

Description-Behavior Mismatch

High

Confidence: 98% confidence
Finding: The skill goes beyond public WIKI lookup and implements account login, token handling, role-detail retrieval, and local storage of a user's private roster data. In an agent-skill context, this materially expands the trust boundary from public content retrieval to collection and persistence of sensitive account-linked gameplay data, increasing privacy and credential-handling risk.

Context-Inappropriate Capability

High

Confidence: 97% confidence
Finding: This code adds a browser-assisted WAF-bypass scraping path for community posts, which is outside the core public JSON WIKI query scope and intentionally circumvents access controls on another endpoint. In a skill environment, embedding bypass logic raises both policy and security concerns because it normalizes fetching protected content through automation the user may not expect.

Description-Behavior Mismatch

Medium

Confidence: 88% confidence
Finding: The skill exposes local media download and video-conversion capabilities that are not reflected in the manifest's primary WIKI-query description. In an agent context, undisclosed file-writing behavior can surprise users, consume disk space, and create a path for storing untrusted remote content locally without clear consent.

Vague Triggers

Medium

Confidence: 84% confidence
Finding: The trigger keywords are broad generic game terms, making the skill likely to auto-activate during ordinary conversation about the game rather than only when the user intends tool use. Over-broad activation is risky here because the skill includes shell, network, scraping, and account-related behaviors.

Vague Triggers

Medium

Confidence: 86% confidence
Finding: Account-oriented trigger phrases such as '我的账号' or '我的角色' are common speech and may cause the skill to move toward login or account workflows unexpectedly. Because the skill stores account data and initiates browser-based authentication, accidental activation has meaningful privacy consequences.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The documentation describes automatic downloading of media files and later deletion from a temp directory without a prominent user-facing warning. Hidden filesystem side effects can surprise users, consume disk space, and create residual artifacts if cleanup fails.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The login flow stores account tokens and detailed roster data in local cache files, but the documentation does not foreground privacy, retention, or security implications. Persisting account.json and role details locally creates clear confidentiality risk if the host machine, logs, or agent environment are shared or compromised.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The account object is written in plaintext JSON to disk and contains sensitive fields such as phone number, token, device ID, role list, and role details. Without any user-facing warning or filesystem protections, local compromise or accidental disclosure can expose the user's account-linked game data and reusable authentication state.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

Detected: suspicious.dynamic_code_execution

Dynamic code execution detected.

Critical

Code: suspicious.dynamic_code_execution
Location: scripts/wikiquery.py:1269