Security audit

Browser Cookie Manager

Security checks for vulnerabilities and agentic risk

Overview

This skill openly reads browser cookies, but it exposes sensitive session credentials too easily and without enough safeguards.

Install only if you explicitly need to export your own browser cookies for a named domain and can protect the output like a password. Avoid sharing terminal logs or saved files, avoid the cURL output unless you inspect and safely quote it, and prefer running it in a controlled environment with a pinned dependency version.

A.I.G

Vulnerability Patterns

Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions

Findings (3)

T05 · Unauthorized Access and Privilege Escalation

Error

Location: scripts/read_cookie.py:66
Finding: Browser Session Cookies Are Extracted and Disclosed in Plaintext
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/read_cookie.py:43
Finding: Generated cURL Command Is Vulnerable to Shell Injection
Content: View full analysis
str: """将 Cookie 转换为 HTTP Header 格式""" cookie_pairs = [] for cookie in cookies: if cookie.get('name') and cookie.get('value'): cookie_pairs.append(f"{cookie['name']}={cookie['value']}") return "; ".join(cookie_pairs) def format_curl(cookies: list, url: str) -> str: """将 Cookie 转换为 cURL 格式""" cookie_header = format_cookie_header(cookies) return f'curl "{url}" -H "Cookie: {cookie_header}"' ``` The URL includes the command-line domain without validation: ```python elif args.output_format == 'curl': url = f"https://{args.domain}" output = format_curl(cookies, url) print("\n=== cURL Command ===") ``` ### Technical Analysis The generated command interpolates the domain and cookie names and values into a shell command enclosed in double quotes. No shell escaping or strict domain validation is applied. Double quotes do not neutralize all shell metacharacters. In common shells, command substitutions such as `$(command)` and backtick expressions are still evaluated inside double-quoted strings. Embedded double quotes can also terminate the intended argument and alter the command structure. The script only prints the command and does not execute it itself. Exploitation therefore requires a user or automation system to execute the generated command. Cookie values may originate from websites and should not be trusted as shell-safe content. The user-controlled domain is another possible injection source, although exploitation through that field depends on the cookie library returning cookies for the supplied domain expression. ### Attack Path 1. A malicious or compromised website places a specially crafted cookie value in the victim's bro ...[truncated 1313 chars]
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: scripts/read_cookie.py:12
Finding: Security-Critical Third-Party Dependency Is Not Enforced or Integrity-Pinned
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The skill handles browser cookies, which often function as bearer tokens for active sessions, but its description and usage section do not prominently warn that outputting cookies to terminal, headers, curl commands, or files can expose account access. The minimal 'personal use' disclaimer does not mitigate the operational risk of leaking secrets through logs, shell history, shared files, or copied commands.
Content: No source excerpt is available for this finding.

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: This script extracts browser cookies for an arbitrary domain and then prints them to stdout or writes them to a file in reusable formats such as a Cookie header or cURL command. Browser cookies often function as bearer tokens for authenticated sessions, so exposing them without an explicit warning, confirmation step, masking, or scope restrictions materially increases the risk of credential theft, session hijacking, and accidental disclosure through terminals, logs, shell history, or shared files.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 93% confidence
Finding: The skill advertises the ability to read browser cookies and write them to files, which are highly sensitive authentication artifacts, yet it declares no explicit tool/permission scope. Without constrained allowed-tools or permissions, an agent may invoke shell and file-write capabilities more broadly than users expect, increasing the chance of unauthorized cookie extraction, persistence, or exfiltration.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The trigger condition, 'When you need to quickly get cookies from browsers,' is overly broad and can cause the skill to activate in many contexts involving browser access, login troubleshooting, or web automation. Because cookies can directly grant authenticated session access, broad activation raises the risk that the agent suggests or runs this skill in situations where the user did not intend sensitive credential extraction.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: All docstrings, help text, and runtime messages are presented only in Chinese, with no option for users to select another language. The stated policy flags language or locale constraints when they are imposed without user opt-in or clear justification.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.