T09 · Insecure Skill Coding Practices
Error
- Location
scripts/scrape.js:393- Finding
Chromium Security Sandbox Disabled for Untrusted Remote Content
- Content
View full analysis
- Remediation
View remediation
Security audit
Grok Scraper
Security checks for vulnerabilities and agentic risk
Overview
This skill is not plainly malicious, but it automates a logged-in X/Grok browser session and stores reusable account data locally with weak safeguards.
Review carefully before installing. Use only on a machine where you are comfortable storing an X/Grok browser session, keep session/ and output/ private, avoid shared folders and backups, and do not run it from cron unless you accept unattended account activity. Prefer isolating it in a dedicated OS account or container and removing the --no-sandbox browser flag where possible.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/login.js:9- Finding
Authenticated X Browser Profile Stored Inside the Project Without Explicit Protection
- Content
View full analysis
{ console.log('🐾 Starting browser, please log in to x.com in the opened window...'); console.log('📂 Session will be saved to:', SESSION_DIR); console.log(''); console.log('✅ After logging in, press Enter in the terminal to save the session and close the browser.'); console.log(''); const context = await chromium.launchPersistentContext(SESSION_DIR, { headless: false, channel: 'chromium', viewport: { width: 1280, height: 900 }, args: ['--disable-blink-features=AutomationControlled'], }); ``` `scripts/scrape.js:23`: ```js const SESSION_DIR = path.join(__dirname, '..', 'session'); ``` `scripts/scrape.js:377-393`: ```js if (!fs.existsSync(SESSION_DIR)) { console.error('❌ Session does not exist, please run: npm run login first'); process.exit(2); } fs.mkdirSync(OUTPUT_DIR, { recursive: true }); console.log(''); console.log('╔══════════════════════════════════════════╗'); console.log('║ 🐾 Grok Scraper v7 — Starting ║'); console.log('╚══════════════════════════════════════════╝'); console.log(''); console.log('🐾 Starting browser...'); if (recordTarget !== null) { console.log(`🎬 Record mode enabled — size: ${recordSize.width}x${recordSize.height}, output: ${resolveVideoPath(recordTarget)}`); } const context = await chromium.launchPersistentContext(SESSION_DIR, { ``` The documented repository layout in `README.md:53-66` places the generated profile directly under the project root: ```text grok-scraper/ ├── SKILL.md # Core Agent instructions ├── README.md # Human-readable documentation ├── scripts/ # All execu ...[truncated 2796 chars]- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Rogue AgentSelf-Modification, Session Persistence
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Findings (28)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
The skill is presented as a simple Grok query mechanism, but its documented behavior includes manual x.com authentication, creation of a reusable browser session, and local storage of session material. That mismatch is dangerous because it obscures the fact that the skill handles persistent authenticated state for a third-party account, which can expose users to credential/session theft risk, policy violations, or unintended actions under their account.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The documentation explicitly promotes bypassing official API restrictions by driving Grok through a logged-in X Premium browser session. That is a strong indicator of intentional evasion of platform controls, and it normalizes credential-backed scraping in place of supported access patterns, which increases legal, account security, and abuse risk.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The README states that browser session data is stored locally and scraped results are persisted to disk, but it does not warn that these artifacts may contain authenticated cookies, tokens, prompts, or sensitive outputs. In a tool that automates a logged-in account, such silent persistence materially raises the risk of credential theft, local compromise, and data leakage.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 88% confidence
- Finding
The README instructs users to run
npx playwrightwithout pinning a specific version, which can pull whatever package/version is current at execution time. This creates a supply-chain risk and undermines reproducibility, especially in a security-sensitive skill that already relies on browser automation and authenticated sessions.- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The README explicitly tells users to log into x.com and save a browser session, but does not clearly warn that authenticated session artifacts will be stored locally and may grant account access if copied or exposed. In the context of a browser automation skill targeting a premium account, persisted session state is sensitive and raises account takeover risk on shared or compromised hosts.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 94% confidence
- Finding
The README instructs users to run
npx playwright install chromiumwithout pinning a specific Playwright version. This can lead to non-reproducible installs and exposure to unexpected upstream changes or a compromised package release, which is meaningful because the tool automates a logged-in browser session against x.com.- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 85% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
3. 定时执行（Cron）
bash crontab -e添加一行，每 6 小时执行一次：
text
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 85% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
3. 定时执行（Cron）
bash crontab -e添加一行，每 6 小时执行一次：
text
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The trigger language is broad enough to match common requests such as 'ask Grok' or 'search X for real-time info,' which can cause the agent to invoke this browser-automation skill in situations where safer built-in tools or APIs would be more appropriate. Because this skill relies on a logged-in Premium X browser session, overbroad activation increases the chance of unnecessary use of authenticated automation and exposure of session-linked data.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The instruction to 'ALWAYS use this skill' encourages unconditional invocation whenever a user mentions Grok or avoiding API billing, bypassing normal tool-selection safety judgment. In context, that is more dangerous because the skill launches a real browser, depends on stored login state, and may route routine information requests through a privileged authenticated session unnecessarily.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 86% confidence
- Finding
Using
npx playwrightwithout pinning a specific version allows the installed package version to vary over time, which weakens build reproducibility and increases supply-chain risk. In a skill that automates browser login and persists authenticated X sessions, an unexpected dependency change could affect security-sensitive behavior or introduce malicious code if the package resolution path is compromised.- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The guide instructs users to rely on specific Chinese-language labels such as "粗体 class",
aria-label="重新生成", and a Chinese test prompt. This creates a locale-specific workflow without user opt-in or documentation that the skill is intended only for a Chinese-language X/Twitter environment, which is a natural-language locale policy concern.- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
This markdown file is in Chinese and relies on the exact Chinese aria-label value
重新生成as the stable selector. That creates a locale-specific assumption for skill operation, but the document does not state that the workflow only applies to a Chinese-language X/Twitter UI or provide an opt-in or alternative for other locales.- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The script takes a screenshot of the Grok/X session and writes extracted DOM/chat structure to local files in the output directory. In the context of a browser session tied to a persistent profile, those artifacts can capture prompts, model responses, account state, or other sensitive page content, creating unintended local data retention and possible later exposure.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The default prompt instructs Grok to answer in Chinese (
用 Markdown 格式...介绍 Python 语言的3个优点), and the surrounding user-facing messages are also Chinese. For a general-purpose DOM inspection tool, this imposes a locale choice without opt-in, which matches the language/locale policy violation criteria.- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The script extracts the full Grok reply container HTML from an authenticated browser session and writes it to disk for offline analysis. That can capture more than just the intended selector metadata, including user-visible content and surrounding page structure, creating unnecessary local data retention and increasing exposure if the workstation, repo, or output directory is later accessed by others.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The script saves captured reply HTML from a live logged-in session to a local file without a prominent warning, consent step, or retention controls. This can unintentionally store sensitive prompts, responses, and nearby DOM content on disk, where they may be exposed through backups, shared folders, or source-control mistakes.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The code defines a session directory on disk and uses launchPersistentContext to store authenticated browser state locally. Persisted session artifacts can contain cookies and tokens that allow later access to the user's x.com account, so compromise of the local filesystem or reuse by unrelated automation can expose the account without reauthentication.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The script launches a persistent browser profile, directs the user to log into x.com, and saves the authenticated session for later reuse. That creates durable access to the user's account beyond a one-off Grok query and exceeds the narrow user-facing purpose of simple querying/search, increasing the risk of account misuse if the session directory is reused, copied, or accessed by other code.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
This code formats the generated timestamp using
toLocaleString('zh-CN', { timeZone: 'Asia/Shanghai' }), which forces a specific language/locale and regional timezone in the output. The file does not provide any user opt-in, configuration, or documented justification for this locale restriction.- Content
Context-Inappropriate Capability
Low
- Category
- Not specified by scanner
- Confidence
- 79% confidence
- Finding
The cron-based scheduled execution turns the skill from an interactive query helper into unattended persistent automation against a logged-in web session. In this context, that increases the chance of account misuse, stealthy long-term scraping, and repeated execution without user awareness or review.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 86% confidence
- Finding
The README recommends scheduled execution and notes that results and logs are written to disk, but does not warn that prompts, Grok responses, operational logs, and failure markers may persist and be readable by other local users or included in backups. This can expose sensitive queries, scraped content, or metadata over time, especially in unattended cron deployments.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
This markdown file is entirely in Chinese, including the title, section headings, and explanatory content, and it does not indicate that the skill or documentation is region-specific or that users may choose another language. Under the language/locale policy, forcing a specific language without opt-in can be a natural-language policy violation.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
The file’s descriptive comments and several inline comments are written in Chinese, which imposes a language expectation on operators without any opt-in or stated regional justification. Under the policy, forcing a specific language without user choice is a natural-language locale violation.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The file header and inline comment use Chinese exclusively for key usage instructions, while the runtime messages are in English. This creates a language/locale policy concern because the skill does not offer user opt-in or an alternative language for those instructions.
- Content
Static analysis
No suspicious patterns detected.