Drission Sota Toolkit

• Outcome: Review
• Latest audit: May 29, 2026 · 9:24 PM UTC
• Version: 7.1.0

Overview

This skill needs Review because it includes high-impact local Chrome control and anti-bot automation that are only partly and inconsistently disclosed.

Install only if you intentionally need advanced local browser/CDP automation and can run it in an isolated VM or container with a disposable, non-logged-in browser profile. Avoid using it against protected third-party services without authorization, and ask the publisher to align _meta.json with the real capabilities, remove offensive examples, and replace the weak/inconsistent gates with explicit per-action confirmation and allowlists.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (17)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence
• Finding: The skill advertises substantial capabilities including file access, networking, shell-related execution requirements, and browser automation, but does not declare corresponding permissions. This creates a transparency and policy-enforcement gap: users and hosting systems cannot accurately assess or constrain what the skill may do, increasing the chance of unintended file, network, or process abuse.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: The declared description frames the skill as a web intelligence toolkit, but the documented asset inventory and behavior include direct Chrome DevTools Protocol takeover, browser injection, local socket relaying, and wrapper-mediated execution of protected scripts. That mismatch is dangerous because it obscures invasive control features behind a benign description, making risky automation and local-control primitives easier to introduce without proper review or user consent.

Description-Behavior Mismatch

High

• Confidence: 95% confidence
• Finding: The manifest claims the skill is a minimal, low-risk scraper while its metadata and dependency set support full browser automation and more advanced web interaction than disclosed. This kind of capability mismatch is dangerous because it can conceal higher-risk behavior from reviewers and downstream users, reducing scrutiny and enabling misuse under a benign description.

Intent-Code Divergence

Medium

• Confidence: 91% confidence
• Finding: The explicit claim that no high-risk capabilities are included conflicts with surrounding metadata advertising stronger automation tooling, which is a classic trust-signaling discrepancy. In a security review context, deceptive minimization increases danger because operators may approve or run the skill under false assumptions about what it can do.

Description-Behavior Mismatch

Medium

• Confidence: 91% confidence
• Finding: The script explicitly invokes a function named direct_page_takeover() and prints that it is executing a 'high-privilege page takeover,' which strongly indicates an offensive capability rather than ordinary web automation. The presence of verify_access_control() does not neutralize the risk, because a local gate only restricts who can launch the behavior and does not change the underlying capability to perform unauthorized takeover actions.

Context-Inappropriate Capability

High

• Confidence: 95% confidence
• Finding: A page-takeover feature is materially inconsistent with the stated purpose of a 'Professional Web Intelligence & Automation Toolkit' and suggests hidden privilege-escalation or unauthorized control functionality. In this skill context, the mismatch is more dangerous because the toolkit branding and mention of hardened gating can be used to disguise or legitimize behavior that exceeds normal automation scope.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: This script explicitly connects to a local Chrome DevTools Protocol endpoint and establishes a takeover session, which can grant access to browser state, cookies, tabs, and arbitrary browser automation. The presence of a local UDS handshake does not change the fact that the capability is a browser-session takeover primitive, and in a web intelligence/automation toolkit this substantially increases the risk of credential theft, surveillance, or unauthorized browser control.

Intent-Code Divergence

Low

• Confidence: 90% confidence
• Finding: The docstring frames the feature as protected and verified, but the underlying behavior still performs raw attachment to a browser debugging session. This kind of reassuring security language can mislead reviewers or operators into underestimating the danger of a capability that enables unauthorized browser control, making the implementation more likely to be deployed unsafely.

Context-Inappropriate Capability

Medium

• Confidence: 94% confidence
• Finding: This code directly attaches to a local Chrome DevTools endpoint and issues raw browser commands through BrowserDriver, bypassing higher-level safety controls and normal browser-session ownership checks. In a web automation toolkit, that is especially dangerous because any accessible debugging port can expose active browser state, cookies, authenticated tabs, and arbitrary page/script execution, enabling session hijacking or unauthorized browser manipulation.

Intent-Code Divergence

Low

• Confidence: 88% confidence
• Finding: The docstring presents the environment variable check as a meaningful safety mechanism, but the code only tests whether SOTA_NUCLEAR_CONFIRMED equals the string 'true'. That is not a real security boundary: any caller, wrapper script, or compromised environment can set it, which may cause operators to overtrust a highly privileged capability that attaches to a browser debug interface.

Description-Behavior Mismatch

Medium

• Confidence: 94% confidence
• Finding: The code targets a specific third-party site and explicitly uses browser impersonation to evade bot detection, while framing the activity as a successful 'breach' and storing proof of success. Even though the technical action here is only fetching a public page and parsing headlines, the combination of anti-bot evasion language, targeted access, and artifact creation makes this an abuse-enabling automation pattern rather than a neutral demo.

Intent-Code Divergence

Low

• Confidence: 88% confidence
• Finding: The script's messaging misrepresents ordinary retrieval of a public blog page as a 'breach' and 'victory,' which can normalize unauthorized-access behavior and encourage misuse of the toolkit. This kind of deceptive or sensational framing is dangerous in a security-sensitive skill because it signals anti-detection intent and can mislead operators about acceptable use.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The code unconditionally launches Chromium with the '--no-sandbox' flag, which disables an important browser security boundary. In a toolkit explicitly designed for web intelligence and automation, this increases risk if untrusted web content is visited or a browser exploit is triggered, because compromise of the browser process can more easily impact the host environment.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The function sends the user-provided query directly to third-party services (arXiv and DuckDuckGo) without any explicit consent, warning, or privacy notice. In a web intelligence tool, queries may contain sensitive research topics, internal project names, or personal data, so silent transmission to external services creates a real privacy and data-handling risk.

Missing User Warnings

Low

• Confidence: 90% confidence
• Finding: The script writes collected search results to a persistent JSON file in the local assets directory without clearly warning the user that data will be stored on disk. Even if the saved content is only search output, it can reveal user interests, investigation topics, or sensitive operational context to other local users, backups, or later processes.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The wrapper executes a script taken from command-line arguments via run_protected_script(script_name) after only a generic challenge prompt, without clearly disclosing which script will run or requiring explicit confirmation of the target. In a toolkit explicitly focused on web intelligence, protocol evasion, and local relaying, this lack of transparency increases the risk of socially engineered or unintended execution of dangerous automation code under the guise of a 'secure' gate.

Natural-Language Policy Violations

High

• Confidence: 95% confidence
• Finding: The natural-language strings repeatedly promote unauthorized 'breach' behavior and success against a named vendor, which materially increases the risk that the skill will be used for hostile or policy-violating activity. In the context of a web automation toolkit that advertises protocol impersonation and socket relaying, this language makes the sample more dangerous because it operationalizes anti-bot evasion rather than legitimate testing.

VirusTotal

66/66 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.