CDE 药物查询（drug query in CDE/CENTER FOR DRUG EVALUATION)

• Outcome: Review
• Latest audit: Sep 16, 2026 · 6:22 AM UTC
• Version: 1.0.4

Overview

The skill mostly does what it claims, but its live browser automation uses under-disclosed stealth settings and disables Chrome's sandbox while loading a public website.

Review before installing. Run it only in an isolated virtual environment under an unprivileged user, keep Chrome/Chromium patched, and avoid sensitive host mounts if using containers. The publisher should remove or make opt-in the Chrome --no-sandbox mode and automation-disguise settings, and pin Selenium to an exact reviewed version.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/cde_client.py:652

Finding

Chrome Browser Sandbox Disabled for Remote Web Content

Content

View full analysis

Vulnerability Details

File Location: scripts/cde_client.py, lines 652-663
Vulnerability Type: Browser security boundary disabled
Risk Level: Medium

python

options = webdriver.ChromeOptions()
if self.headless:
    options.add_argument("--headless=new")
options.add_argument("--window-size=1440,1200")
options.add_argument("--disable-dev-shm-usage")
options.add_argument("--disable-blink-features=AutomationControlled")
options.add_argument("--no-sandbox")
options.add_argument("--lang=zh-CN")
options.add_argument(
    "--user-agent=Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36"
)
options.set_capability("goog:loggingPrefs", {"performance": "ALL"})

Technical Analysis

The Selenium client launches Chrome with --no-sandbox. The skill then visits and executes active content from the live CDE website. Chrome's sandbox normally isolates renderer processes and limits the consequences of a renderer or web-content compromise. Disabling it removes a defense-in-depth boundary and gives a successful browser exploit a more direct path to the privileges of the Chrome process.

The flag is not required for the skill's declared data-query functionality on a normally configured desktop. It is sometimes used as a workaround in containers, but applying it unconditionally exposes every execution environment to the weaker security configuration.

This option does not independently create arbitrary code execution. Exploitation requires malicious or compromised remote content and a compatible browser vulnerability.

Attack Path

1. The user invokes a query, causing Selenium to start Chrome.
2. Chrome starts with its process sandbox disabled.
3. The browser loads the live CDE page and associated remote resources.
4. An attacker compromises the remote site or a resource it serves, or otherwise causes the page to deliver content that exploit ...[truncated 791 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove options.add_argument("--no-sandbox") from the default browser configuration.
2. Run Chrome as an unprivileged, dedicated operating-system user.
3. If a restricted container cannot support Chrome's sandbox, provide a clearly named explicit opt-in option rather than disabling it universally.
4. Document that the opt-in mode weakens browser isolation and must only be used inside a hardened disposable container.
5. For container deployments, avoid root execution, sensitive host mounts, host networking, and unnecessary Linux capabilities.
6. Keep Chrome and its driver integration current with security patches.
7. Consider enforcing navigation and resource policies so the automated browser only accesses expected HTTPS origins.

T08 · Insecure Dependencies

Note

• Location: scripts/requirements.txt:1

Finding

Unbounded Selenium Dependency Prevents Reproducible and Auditable Installation

Content

View full analysis

Vulnerability Details

File Location: scripts/requirements.txt, line 1
Vulnerability Type: Unpinned third-party dependency
Risk Level: Low

text

selenium>=4.20.0

The dependency is installed through commands documented in SKILL.md and references/setup.md, such as:

bash

python -m pip install -r ./scripts/requirements.txt

Technical Analysis

The open-ended >=4.20.0 constraint permits pip to install any compatible future Selenium release. No lock file, exact transitive dependency versions, or package hashes are present in the audited project.

Consequently, two installations performed at different times can resolve to different code. This weakens release review because the dependency code executed by a deployed copy is not necessarily the dependency version that was evaluated when the skill was audited. The exposure also extends to Selenium's transitive dependency graph.

This is a supply-chain hardening issue rather than evidence that the current Selenium package is malicious. Exploitation requires compromise of the package source, a malicious dependency release, or an unsafe future version accepted by the broad constraint.

Attack Path

1. An attacker compromises a permitted Selenium release, one of its resolved dependencies, or the configured Python package source.
2. A user follows the documented installation command after the compromised version becomes available.
3. Pip resolves the open-ended constraint to the compromised package set because no exact version or hash rejects it.
4. The compromised dependency is installed into the skill environment.
5. The skill imports and executes Selenium during normal query processing.
6. Malicious dependency code runs with the privileges of the Python process.

Impact Assessment

A compromised dependency could access files, environment variables, browser data, and network resources available to the Python process; alter retur ...[truncated 347 chars]

Remediation

View remediation

Remediation Suggestions

1. Replace the open-ended constraint with an exact, reviewed Selenium version.
2. Generate a lock file that fixes all transitive dependency versions for each supported Python environment.
3. Record cryptographic hashes for downloaded distributions and install with pip --require-hashes.
4. Use a trusted package index explicitly and prohibit unreviewed supplemental indexes.
5. Perform dependency updates through controlled pull requests with vulnerability and provenance checks.
6. Add automated software-composition analysis and periodic review for known vulnerabilities.
7. Test locked dependency updates before publishing a new skill release.

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 193)May include surrounding context.

md

- If the CDE page structure has changed, update the selector and parsing logic in `scripts/cde_client.py` before relying on the result.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The code deliberately disguises Selenium automation by disabling AutomationControlled, overriding navigator.webdriver, spoofing languages/plugins, and setting a custom browser fingerprint. That goes beyond normal public-site querying and is risky because it is designed to bypass bot-detection controls a site operator may rely on for abuse prevention, rate limiting, or terms enforcement.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

This code explicitly sets the browser language to zh-CN and overrides navigator.languages to prioritize Chinese. That is a natural-language/locale policy concern because the skill enforces a specific locale rather than offering the user a choice or documenting a justified regional constraint.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

The user-facing output strings in the pretty-print path are hard-coded in Chinese for field labels such as drug, drug type, application type, status, and entered-center time. This imposes a specific language on users without opt-in or an alternative locale, which matches the language/locale policy concern.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 97% confidence

Finding

The dependency is specified as selenium>=4.20.0, which is not reproducible and allows future installs to resolve to different versions over time. This increases supply-chain risk and makes it harder to verify whether a deployed environment contains a vulnerable or tested release.

Content

Scanner excerpt · scripts/requirements.txt (reported line 1)May include surrounding context.

text

selenium>=4.20.0

Unverifiable Dependency: selenium has 2 known advisory(ies) (CVE-2022-28108 (Selenium Server (Grid) before 4 allows CSRF because it permits non-JSON content ); CVE-2023-5590 (NULL Pointer Dereference in GitHub repository seleniumhq/selenium prior to 4.14.)), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 84% confidence

Finding

Because the manifest does not pin an exact Selenium version, it is not possible to determine from this file alone whether installations will use a release affected by known advisories or a later fixed version. In this skill context, Selenium is a common browser automation library and there is no direct sign of malicious use, but the lack of version control weakens assurance and can expose deployments to avoidable vulnerable dependency resolution.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.