T09 · Insecure Skill Coding Practices
Error
- Location
scripts/qwen_agent.py:19- Finding
Chromium Is Launched with Browser Sandbox Protection Disabled
- Content
View full analysis
- Remediation
View remediation
Security audit
Qwen Web Agent
Security checks for vulnerabilities and agentic risk
Overview
The skill mostly matches its Qwen browser-automation purpose, but it needs review because it stores login/transcript data locally and automatically deletes Qwen conversations from a persistent logged-in account.
Install only after reviewing the scripts and preferably modifying them to remove automatic deletion, remove --no-sandbox, use a dedicated Qwen account/profile, and redirect or disable transcript logging. Treat ~/.qwen_session/ and the markdown output files as sensitive because they can contain login state, prompts, and model responses.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/qwen_agent.py:124- Finding
Fixed Sidebar Index Can Cause Deletion of an Unrelated Conversation
- Content
View full analysis
- Remediation
View remediation
T08 · Insecure Dependencies
Warning
- Location
SKILL.md:40- Finding
Third-Party Dependencies Are Installed Without Version or Integrity Pinning
- Content
View full analysis
- Remediation
View remediation
--hash=sha256: ``` 4. Generate hashes from trusted artifacts and review dependency updates before changing the lockfile. 5. Use a dedicated virtual environment and avoid installation with root or administrator privileges. 6. Document the expected trusted package index and reject untrusted extra indexes. 7. Pin and document the corresponding Playwright browser revision. 8. Integrate dependency vulnerability scanning and scheduled update review into project maintenance. ]]>
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (21)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 93% confidence
- Finding
The skill claims browser querying and response capture, but it also persists full conversation history locally and deletes conversation history in the web UI. This mismatch is security-relevant because it conceals data retention and destructive actions that can affect confidentiality and availability.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
The skill claims browser querying and response capture, but it also persists full conversation history locally and deletes conversation history in the web UI. This mismatch is security-relevant because it conceals data retention and destructive actions that can affect confidentiality and availability.
- Content
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
Writing transcripts to a hard-coded personal notes path is unjustified for a browser automation skill and increases the likelihood of data ending up in an unrelated repository, sync service, or note-taking system. The destination suggests the data may be mixed with personal knowledge stores, broadening exposure beyond the skill's operational needs.
- Content
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The cleanup logic automatically deletes a Qwen conversation in the web UI even though deletion is not part of the stated skill purpose. This is dangerous because it destroys user data and audit history without explicit consent, and a browser automation skill with a persistent logged-in session has the capability to perform that action on a real account.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The script performs remote destructive action by deleting the conversation from the Qwen UI without explicit confirmation. Since the skill uses a real logged-in browser profile, this can remove user-visible records and impede review or recovery of prior interactions.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 83% confidence
- Finding
The skill advertises browser automation that writes outputs to local files, but it does not declare any tool scope or permission boundary for file writes. In an agent ecosystem, missing explicit permissions increases the chance of unintended file modification or data persistence without operator awareness.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
Persisting login session data locally and reusing it across runs creates a credential-bearing artifact that can be abused by other local users, processes, or later tasks. The danger is amplified because the description does not clearly warn users that authentication state is retained beyond a single run.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
Writing prompts and model outputs to local files can retain sensitive user data, secrets, or regulated content long after the browser session ends. Without an explicit warning, users and upstream agents may unknowingly disclose or persist data in locations that are later accessible to other processes.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
Multi-turn mode stores all conversation turns in a history file, which can accumulate sensitive prompts, AI outputs, credentials, personal data, or proprietary information in plain text. In this skill's context, repeated agent-driven interactions make retention risk higher because large volumes of data may be captured automatically without review.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The documentation instructs users to retain a persistent browser session under ~/.qwen_session/ but does not warn that this directory may contain cookies, tokens, and other authentication material. On a multi-user machine, backup system, or synced home directory, compromise of that folder could allow account reuse or session hijacking without re-authentication.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The script writes captured prompts and Qwen responses to a fixed local markdown file path, creating undeclared persistence of potentially sensitive data. Because the path is hard-coded, users may be unaware of where data is stored, and subsequent runs can overwrite or expose prior sensitive output on disk.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The skill sends arbitrary query content to qianwen.com, which may include secrets, proprietary data, or personal information, without any explicit privacy gating or warning. In an agent setting, upstream callers may assume local processing, so silent transmission to a third-party web service increases the risk of unintended data disclosure.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The skill performs an automatic destructive action by deleting the current Qwen conversation after extracting the response, yet the skill description presents it as browser querying and response capture only. This can destroy user data or audit history unexpectedly, especially because it runs against a persistent logged-in browser profile and does not request confirmation before deletion.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The script automatically deletes the conversation through UI automation without warning or confirmation from the user. This is dangerous because it irreversibly removes conversation history in a real logged-in account, undermining user expectations, traceability, and the ability to recover or verify what was sent and received.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The script searches for menu items and confirmation buttons using the Chinese strings "删除此对话" and "确定", which assumes a Chinese-language interface. This creates a locale-specific constraint that is neither optional nor documented, and users in other locales are not given a choice.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The script hard-codes persistence of full prompts and model replies to a local Markdown file outside the declared skill behavior. Because this skill brokers arbitrary user questions to an external AI service, transcripts may contain credentials, proprietary data, or personal information, and silently storing them creates a clear confidentiality risk.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
Persistently recording full natural-language prompts and responses in plain text creates a data leakage channel because conversations often contain secrets, internal context, or personal data. In this skill, the risk is amplified because the transcript is generated from arbitrary agent/user inputs and then stored unencrypted in a local file.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The code appends every query and answer to a history file without warning the user that sensitive natural-language content will be retained. In this skill context, users are likely to submit arbitrary prompts and pasted data, so undisclosed persistence materially increases privacy and secrecy risks.
- Content
Description-Behavior Mismatch
Low
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The file describes the skill as a browser automation script for interacting with the Qwen web interface, but it also states that replies are saved locally to Markdown files. Local file persistence is behavior beyond pure browser query/response automation, and the specific output side effect is not reflected in the manifest description provided.
- Content
Description-Behavior Mismatch
Low
- Category
- Not specified by scanner
- Confidence
- 81% confidence
- Finding
The manifest emphasizes launching a browser, sending queries, and capturing replies, but this documentation adds that the script stores browser context under ~/.qwen_session/ for persistent login. Disk persistence of authentication/session material is a meaningful additional behavior not clearly disclosed in the manifest summary.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The documentation says replies are written to a fixed local file and overwritten each run, but does not warn that prompts and model outputs may contain sensitive or regulated data. In this skill's context, automating AI queries increases the chance that users submit confidential material, which then gets persistently stored in a predictable path and may be exposed through local access, backups, or sync tools.
- Content
Static analysis
No suspicious patterns detected.