Security audit

Qwen Orchestrator

Security checks across malware telemetry and agentic risk

Overview

This skill does what it claims, but it needs review because it sends user content to Qwen through a persistent logged-in browser and stores sensitive browser-control state locally.

Install only if you are comfortable with selected prompts, pasted text, stdin, and session context being sent to Qwen Chat. Use a dedicated Qwen account, avoid secrets or regulated/proprietary data, keep the skill directory private, and review or disable PM2 startup and daemon endpoint files if you do not want a persistent authenticated browser service.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (7)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 93% confidence
Finding: The skill clearly performs networked browser automation against an external service and uses environment/config state, but the markdown does not declare permissions or trust boundaries. That omission can cause users or higher-level agents to invoke it without understanding that external data transfer and local state access will occur.

Context-Inappropriate Capability

Medium

Confidence: 95% confidence
Finding: The script kills Chrome processes associated with a profile and runs shell commands to delete Chrome shared-memory/tmp artifacts. That gives the skill host-level process-control and deletion capability beyond what is required to automate a browser tab, increasing the blast radius if the logic misidentifies processes or paths. In this skill context, local host control is more dangerous because the tool is supposed to be a chat orchestrator, not a system-management utility.

Context-Inappropriate Capability

Low

Confidence: 80% confidence
Finding: The code spawns a shell via execSync('which ...') to locate a browser binary. While limited in scope, invoking a shell is unnecessary for core chat functionality and expands attack surface, especially in environments where PATH or shell behavior may be manipulated. In a browser automation skill, this is less severe than arbitrary command execution but still an unnecessary privileged capability.

Vague Triggers

Medium

Confidence: 78% confidence
Finding: The invocation guidance is broad enough to route many generic code-analysis, review, summarization, and search tasks into this skill even when the user may not intend third-party transmission. In context, that increases the chance that sensitive source code or documents are sent to Qwen through browser automation without a specific consent checkpoint.

Missing User Warnings

High

Confidence: 98% confidence
Finding: The skill advertises piping code and text directly into a browser-automated third-party chat service but does not prominently warn that prompts and stdin content are transmitted off-host to chat.qwen.ai. This creates a real confidentiality and compliance risk because users may assume analysis is local or internal to the agent platform.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The skill sends full prompt content to chat.qwen.ai, including prompts read from files, without any inline consent gate or prominent disclosure in this file. This can expose sensitive local data, source code, secrets, or proprietary text to a third-party service, which is especially relevant because the skill is marketed for code analysis and review where sensitive inputs are common.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The daemon writes the browser DevTools WebSocket endpoint and process metadata to predictable local files. Access to a Chrome/Puppeteer wsEndpoint typically grants powerful remote control over the live browser session, including page interaction, cookie/session access via DevTools, and use of the authenticated Qwen session, so exposing it through local files materially increases takeover risk if other local users, processes, or tools can read those files.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

Detected: suspicious.dangerous_exec

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: ask-puppeteer.js:111

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: scripts/test-followup-continuity.js:11