Security audit

Web Automation Suite

Security checks for vulnerabilities and agentic risk

Overview

This browser automation skill is coherent, but it can reuse logged-in browser sessions and automatically submit or post content without clear safeguards.

Review this skill before installing. Use it only in an isolated browser profile or test account, avoid saving personal or administrative login sessions in browser-state.json, do not commit or share generated state files or logs, and require explicit review before form submissions, uploads, batch posts, or scheduled runs.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

Location: README.md:7
Finding: Unpinned Playwright Installation Creates a Mutable Supply-Chain Dependency
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.md:220
Finding: Authentication State Is Stored in a Predictable Plaintext File
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (12)

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The skill instructs users to save and reload browser storage state to a local JSON file without warning that this can persist authentication cookies, session tokens, and other sensitive state. If that file is exposed, reused across tasks, or stored insecurely, an attacker or unintended process could hijack authenticated sessions and access user accounts.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 82% confidence
Finding: This markdown file includes examples for filling credentials into forms and submitting them, but it does not warn users that browser automation may transmit or modify user data on external websites. Under the markdown-specific warning rule, behaviors affecting privacy or user data should be disclosed in the skill description.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The listed trigger scenarios include broad phrases like '自动抓取网页', '自动化填表', and '定时任务执行' without defining when this skill should or should not activate. Because the description provides only generic scenarios and no exclusions or explicit trigger phrases, it risks unintended invocation for many ordinary browsing or automation requests.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 86% confidence
Finding: The manifest description is written entirely in Chinese and provides no indication that users can choose another language or that the skill is intended only for a Chinese-speaking or region-specific audience. This creates a natural-language locale policy concern because the skill appears to impose a language choice by default.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 87% confidence
Finding: This code performs potentially impactful actions by submitting forms and posting content to multiple target URLs, including automatic navigation and clicks that can publish or transmit user-provided data. While there is limited error logging elsewhere, these functions provide no confirmation prompt, user-facing disclosure, or warning comment indicating that submission/publication will occur automatically.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The file-level documentation describes this module as a form automation helper supporting batch filling, auto-submit, and file upload, but this function automates navigation to multiple target URLs and publishes content across platforms. Cross-site bulk publishing is a broader capability than assisting with form completion and is not justified by the module's documented purpose in this file.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 84% confidence
Finding: The upload helper reads local file paths and attaches files to a browser form, which is a safety-relevant operation affecting user data. The function has no user-facing log, warning, or explanatory comment about accessing local files or sending them through a form submission workflow.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 72% confidence
Finding: The README content is written entirely in Chinese, including headings and usage instructions, with no indication that users may choose another language. This can be a language policy issue when a skill imposes a specific language without opt-in or documented justification.
Content: No source excerpt is available for this finding.

Vague Triggers

Low

Category: Not specified by scanner
Confidence: 87% confidence
Finding: The phrase '一套搞定所有网页自动化需求' suggests the skill should activate for essentially any web automation request. This broad natural-language scope lacks constraints or negative examples, increasing the chance of accidental or overinclusive invocation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 97% confidence
Finding: This shell script presents all operational instructions and warnings in Chinese, such as the guidance on running scripts and starting Chrome remote debugging. Under the language/locale policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale restriction is documented and justified.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The natural-language documentation and inline descriptions in this file are presented exclusively in Chinese, which can impose a language constraint on users or maintainers without offering an alternative or opt-in. Under the stated policy, forcing a specific language without user choice is a natural-language policy concern.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The natural-language content in the file header and function comments is exclusively Chinese, which can amount to a language policy constraint for maintainers or users consuming this skill. There is no indication that Chinese is optional, selectable, or required for a documented region-specific purpose.
Content: No source excerpt is available for this finding.

Static analysis

Detected: suspicious.dynamic_code_execution

Dynamic code execution detected.

Critical

Code: suspicious.dynamic_code_execution
Location: scripts/scraper-helpers.js:147