news-search

• Outcome: Review
• Latest audit: Sep 12, 2026 · 4:41 AM UTC
• Version: 1.0.0

Overview

This skill appears to be a real news-search tool, but it uses anti-bot browser automation and disables Chromium sandboxing while visiting external sites.

Install only if you are comfortable with a Chinese-language news scraping helper that drives a headless browser against third-party search sites. Run it in an isolated, non-root environment, prefer npm ci with reviewed dependencies, and consider removing the stealth plugin and Chromium no-sandbox flags before using it on a machine with sensitive files or credentials.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/news-search.js:71

Finding

Chromium Security Sandbox Is Explicitly Disabled

Content

View full analysis

Vulnerability Details

File Location: scripts/news-search.js:71-74
Vulnerability Type: Browser sandbox disabled while processing remote web content
Risk Level: High

Vulnerable Code

js

browser = await chromium.launch({ 
  headless: true,
  args: ['--no-sandbox', '--disable-setuid-sandbox']
});

Technical Analysis

The script passes both --no-sandbox and --disable-setuid-sandbox when launching Chromium. These flags disable Chromium's operating-system-level process isolation, which is designed to restrict a compromised renderer from accessing the host environment.

The browser visits search engines and processes remotely supplied HTML, JavaScript, media, advertisements, and third-party resources. Search results can also contain content influenced by external publishers. If any loaded resource exploits a Chromium vulnerability, disabling the sandbox significantly reduces the isolation barriers between the compromised browser process and the Node.js process user's environment.

This issue does not independently provide code execution; exploitation requires a compatible Chromium or browser-engine vulnerability. However, removing the sandbox materially increases the impact of such an exploit.

Attack Path

1. An attacker publishes or injects malicious content that is indexed by one of the supported news search engines, or compromises a third-party resource loaded by a search page.
2. A user invokes the skill with a keyword that causes Chromium to load the attacker-controlled resource.
3. The resource exploits a vulnerability in the installed Chromium build.
4. Because the Chromium sandbox is disabled, the compromised process encounters fewer operating-system isolation boundaries.
5. The attacker may execute actions with the privileges of the account or container running the Node.js process.

Impact Assessment

Successful exploitation could grant access equivalent to the operating-system user running the skill. Depending o ...[truncated 504 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove --no-sandbox and --disable-setuid-sandbox and allow Chromium to use its standard sandbox:

js

browser = await chromium.launch({
  headless: true
});

2. Run the skill as a dedicated, unprivileged operating-system user rather than as root.
3. If the deployment environment cannot support Chromium sandboxing, isolate the entire skill in a hardened container or virtual machine with:
   • A non-root user.
   • A read-only root filesystem.
   • No host filesystem mounts containing sensitive data.
   • Linux capabilities dropped.
   • no-new-privileges enabled.
   • Strict seccomp and AppArmor or SELinux policies.
   • Network egress restricted to the required search-engine domains.
   • CPU, memory, process, and execution-time limits.
4. Keep Playwright and its bundled Chromium version current so that browser security patches are applied promptly.
5. Avoid exposing secrets, credentials, or sensitive host directories to the browser process.

T08 · Insecure Dependencies

Warning

• Location: scripts/package-lock.json:18

Finding

Dependency Lockfile Retrieves Packages from a Third-Party Registry Mirror

Content

View full analysis

Vulnerability Details

File Location: scripts/package-lock.json:18-20
Vulnerability Type: Third-party dependency supply-chain exposure
Risk Level: Medium

Vulnerable Configuration

json

"version": "4.1.12",
"resolved": "https://registry.npmmirror.com/@types/debug/-/debug-4.1.12.tgz",
"integrity": "sha512-vIChWdVG3LG1SMxEvI/AK+FWJthlrqlTu7fbrlywTkkaONwk/UAGaULXRlf8vkzFBLVm0zkMdCquhL5aOjhXPQ==",

The same third-party registry domain is used by the other resolved entries in the lockfile.

Technical Analysis

The lockfile directs npm to retrieve dependency archives from registry.npmmirror.com rather than the official npm registry. This introduces an additional third-party infrastructure trust boundary into installation.

The recorded SHA-512 integrity values allow npm to detect an archive that differs from the artifact originally recorded in the lockfile. This substantially reduces opportunistic in-transit replacement risk. However, integrity metadata does not prove that the artifact was trustworthy when the lockfile was generated, and it does not eliminate risks arising from compromise of the mirror, package provenance, or the environment used to generate the lockfile.

The dependency manifest also uses permissive caret ranges, while the lockfile currently resolves exact versions. Installation should therefore consistently use the reviewed lockfile rather than regenerating dependency resolution from the manifest.

Attack Path

1. A user follows the documented installation procedure and runs npm install, or another installation workflow consumes the committed lockfile.
2. npm retrieves dependency archives from the third-party mirror specified by the lockfile.
3. If a malicious archive and matching lockfile integrity value were introduced during lockfile generation or through a compromised project update, npm would accept that archive.
4. Dependency lifecycle code, imported package code, or browser automation components cou ...[truncated 1077 chars]

Remediation

View remediation

Remediation Suggestions

1. Regenerate the lockfile using the official npm registry:

bash

cd scripts
rm -rf node_modules package-lock.json
npm config set registry https://registry.npmjs.org/
npm install

2. Review the regenerated dependency versions and integrity hashes before committing the lockfile.
3. Use npm ci in automated and production environments so installation strictly follows the reviewed lockfile.
4. Use npm ci --ignore-scripts where dependency lifecycle scripts are not required. If scripts are required, explicitly audit them before permitting execution.
5. Consider pinning direct dependencies to reviewed exact versions instead of permissive caret ranges.
6. Run package installation as a non-root user in an isolated build environment without production credentials.
7. Add automated dependency vulnerability, provenance, and lockfile-change review to the release process.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (11)

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 20)May include surrounding context.

md

进入脚本目录并运行 `news-search.js`：

Known Vulnerable Dependency: brace-expansion==1.1.12 — 4 advisory(ies): CVE-2026-13149 (brace-expansion: DoS via exponential-time expansion of consecutive non-expanding); CVE-2026-33750 (brace-expansion: Zero-step sequence causes process hang and memory exhaustion); CVE-2026-14257 (brace-expansion: DoS via unbounded expansion length causing an out-of-memory pro) +1 more

High

• Category: Supply Chain
• Confidence: 95% confidence

Finding

The lockfile pins brace-expansion 1.1.12, which is flagged with multiple denial-of-service advisories. Even as a transitive dependency, vulnerable parsing or expansion logic can be triggered by crafted input patterns and cause excessive CPU or memory consumption, potentially disrupting the service.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The natural-language instructions and usage guidance are presented in Chinese throughout the file, and the skill does not indicate that users may choose another language or that the Chinese-only requirement is intentional and justified. This can be a language/locale policy issue when a skill effectively forces one language without user opt-in.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill explicitly relies on Playwright browser automation and a stealth plugin to access third-party news sites, but the description does not warn users that it will drive a browser against external services using anti-bot evasion techniques. This creates transparency and consent issues: operators may unknowingly trigger activity that violates site terms, increases detection/blocking risk, or exposes their environment to unreviewed web content during automation.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The script explicitly enables a stealth plugin to evade anti-bot detection and launches Chromium with sandbox protections disabled. For a news-search skill, anti-detection behavior is not necessary to fulfill the stated purpose and increases abuse potential by facilitating scraping that bypasses site defenses and operator policies. The skill context makes this more concerning because it aggregates multiple third-party news sources at scale, which is exactly the kind of automation those defenses are meant to regulate.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The Google News query URL forces hl=zh-CN, gl=CN, and ceid=CN:zh-Hans, which constrains results to a specific language and locale. This is a natural-language policy concern because the skill does not provide an opt-in or configurable locale despite enforcing one.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

Error messages, usage instructions, and status output are written only in Chinese, so the skill imposes a specific language on all users. The file does not offer any language selection or state that it is intentionally limited to a Chinese-speaking audience.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The dependency set includes playwright-extra together with puppeteer-extra-plugin-stealth, which adds anti-bot and anti-detection behavior not required for a simple ordinary news search capability. In a scraping-oriented news aggregation skill this can be used for legitimate compatibility, but it still increases abuse potential by helping automated browsing evade site defenses, rate limits, and monitoring.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 94% confidence

Finding

The dependency uses a caret version range, which allows newer minor/patch releases to be installed over time. This can introduce supply-chain risk or unexpected behavior changes if an upstream package is compromised or ships a breaking or vulnerable update, and this skill’s browser-automation context increases exposure because these packages execute complex external code paths.

Content

Scanner excerpt · scripts/package.json (reported line 13)May include surrounding context.

json

"license": "ISC",
  "description": "News search scripts using Playwright",
  "dependencies": {
    "playwright": "^1.40.0",
    "playwright-extra": "^3.1.2",
    "puppeteer-extra-plugin-stealth": "^2.11.2"
  }

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 95% confidence

Finding

The package is not pinned to an exact version, so future installs may resolve to different code than what was originally tested. That creates a supply-chain integrity risk, especially for automation tooling like playwright-extra that can materially affect browser behavior and may pull in risky transitive changes.

Content

Scanner excerpt · scripts/package.json (reported line 14)May include surrounding context.

json

"description": "News search scripts using Playwright",
  "dependencies": {
    "playwright": "^1.40.0",
    "playwright-extra": "^3.1.2",
    "puppeteer-extra-plugin-stealth": "^2.11.2"
  }
}

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 97% confidence

Finding

This dependency is both unpinned and security-sensitive: a stealth plugin alters browser-detection behavior and would execute code inside the automation stack. Allowing floating updates here increases the risk of silently ingesting compromised or unexpected upstream code, with somewhat higher concern than ordinary libraries due to its anti-detection nature.

Content

Scanner excerpt · scripts/package.json (reported line 15)May include surrounding context.

json

"dependencies": {
    "playwright": "^1.40.0",
    "playwright-extra": "^3.1.2",
    "puppeteer-extra-plugin-stealth": "^2.11.2"
  }
}

Static analysis

No suspicious patterns detected.