Edison Agent Reach

• Outcome: Review
• Latest audit: Sep 11, 2026 · 7:36 AM UTC
• Version: 1.0.0

Overview

This skill is a broad web/platform automation guide whose read-only browsing purpose is coherent, but it also enables account-affecting actions, cookie/session use, anti-bot bypassing, and mutable setup instructions without enough scoping or confirmation.

Review this skill carefully before installing. Use it only if you are comfortable with an agent accessing logged-in platform sessions, using cookies, configuring platform tools, and potentially posting to public or account-bound services. Require explicit confirmation before any publish, comment, setup, cookie use, package installation, Docker operation, or anti-bot workaround, and prefer pinned or locally reviewed setup instructions.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:151

Finding

Unpinned Global npm Package Installation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 151
Vulnerability Type: Unpinned third-party dependency installed globally
Risk Level: Medium

Complete Code Snippet:

markdown

- **Twitter fetch failed?** Ensure `undici` is installed: `npm install -g undici`. Configure proxy: `agent-reach configure proxy URL`.

Technical Analysis

The troubleshooting instructions direct the agent to install undici globally from the npm registry without specifying a reviewed version, lockfile, integrity hash, or provenance check. The version resolved by this command can therefore change after the Skill has been audited.

npm installation can execute package lifecycle scripts. A compromised package release, compromised registry account, or malicious dependency introduced into the resolved dependency graph could consequently run code under the privileges of the account executing the agent. The -g option also expands the scope of the installation by modifying the global Node.js package environment rather than an isolated project environment.

This finding does not establish that undici itself is malicious. The vulnerability is the unsafe, mutable dependency-installation procedure.

Attack Path

1. A user reports that Twitter retrieval is not working.
2. The agent follows the troubleshooting instruction in SKILL.md.
3. The agent executes npm install -g undici.
4. npm resolves the package and dependency versions available from the configured registry at execution time.
5. If the selected release, dependency graph, registry, or package-maintainer account has been compromised, attacker-controlled package installation or lifecycle code executes locally.
6. The malicious code operates with the permissions of the account running npm and can alter globally installed Node.js tooling accessible to that account.

Impact Assessment

Successful exploitation could allow arbitrary code execution with the p ...[truncated 512 chars]

Remediation

View remediation

Remediation Suggestions

• Pin undici to a specifically reviewed version instead of resolving the latest release.
• Use a lockfile and verify package integrity and provenance before installation.
• Install the package within a dedicated, least-privileged project or container rather than with -g.
• Disable lifecycle scripts where they are unnecessary, for example by using an appropriate --ignore-scripts policy after verifying compatibility.
• Require explicit user approval before installing or modifying third-party software.
• Restrict the npm registry to a trusted source and monitor reviewed versions for supply-chain advisories.

T03 · Remote Payload Retrieval and Execution

Warning

• Location: SKILL.md:155

Finding

Mutable Remote Setup Guide Can Introduce Post-Audit Commands

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 155–160
Vulnerability Type: Retrieval and autonomous use of mutable remote instructions
Risk Level: Medium

Complete Code Snippet:

markdown

## Setting Up a Channel ("帮我配 XXX")

If a channel needs setup (cookies, Docker, etc.), fetch the install guide:
https://raw.githubusercontent.com/Panniantong/agent-reach/main/docs/install.md

User only provides cookies. Everything else is your job.

Technical Analysis

The Skill directs the agent to fetch installation instructions from the repository's mutable main branch. The remote document is not pinned to a commit and has no expected hash, signature, or locally reviewed copy. Its contents can therefore change independently after this Skill has passed review.

The accompanying instruction, Everything else is your job, broadly delegates channel setup to the agent. If the remote guide later contains installation commands, downloads, Docker operations, configuration changes, or other executable steps, the agent may treat those changing instructions as authorized setup actions. This creates an indirect remote payload channel in which the effective behavior is controlled by the current contents of an external resource rather than the audited package.

The audited file does not prove that the current remote guide is malicious. The risk arises because a future upstream modification or repository compromise can change the instructions subsequently followed by the agent.

Attack Path

1. A user asks the agent to configure a supported platform channel.
2. The Skill tells the agent to retrieve the installation guide from the main branch URL.
3. Before retrieval, an attacker compromises the upstream repository or maintainer account, or an authorized upstream change introduces unsafe commands.
4. The mutable guide is changed to instruct the agent to download or execute attacker-controlled software, expo ...[truncated 1143 chars]

Remediation

View remediation

Remediation Suggestions

• Vendor a reviewed copy of the setup guide into the Skill package.
• If remote retrieval is necessary, reference an immutable commit rather than the main branch.
• Publish and verify a cryptographic hash or trusted signature for the retrieved document.
• Treat remote documentation as untrusted data rather than automatically authoritative agent instructions.
• Display all proposed installation and system-modification commands to the user and require explicit approval before execution.
• Apply a strict allowlist of permitted setup operations and reject commands involving privilege escalation, arbitrary downloads, credential transmission, startup persistence, or sensitive host mounts.
• Run installation procedures in a least-privileged sandbox or disposable container with narrowly scoped filesystem and network access.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• YARA Signatures: Malware Match, Webshell Match, Cryptominer Match

Findings (6)

YARA rule 'info_stealer': Information stealer patterns (credential harvesting, browser data theft) [malware]

High

• Category: YARA Match
• Confidence: 75% confidence

Finding

The guidance to use '--cookies-from-browser chrome' instructs extraction of authenticated browser cookies for use by command-line tooling. Although presented as troubleshooting, this pattern materially increases the risk of credential/session misuse because it transfers live browser session data into another execution context.

Content

Scanner excerpt · SKILL.md (reported line 68)May include surrounding context.

L" # download subtitles, then read the .vtt file yt-dlp --dump-json "ytsearch5:query" # search

text

## Bilibili (yt-dlp)

```bash
yt-dlp --dump-json "https://www.bilibili.com/video/BVxxx"
yt-dlp --write-sub --write-auto-sub --sub-lang "zh-Hans,zh,en" --convert-subs vtt --skip-download -o "/tmp/%(id)s" "URL"

Server IPs may get 412. Use --cookies-from-browser chrome or configure proxy.

Reddit

bash

curl -s "https://www.reddit.com/r/SUBREDDIT/hot.json?limit=10" -H "User-Agent: agent-reach/1.0"
curl -s "https://www.reddit.com/search.json?q=QUERY&limit=10" -H "User-Agent: agent-reach/1.0"

Server IPs may get 403. Search via Exa instead, or configure proxy.

GitHub (gh CLI)

bash

gh search repos "query" --sort stars --limit 10
gh repo view owner/repo
gh search code "query" --language python
gh issue list -R owner/repo --state open
gh issue view 123 -R owner/repo

小红书 / XiaoHongShu (mcporter)

bas

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The description says the skill should be used when a user asks to post, comment, or interact on supported platforms, but it does not warn that this can modify live external accounts. That omission is dangerous because the skill has real-world side effects and may act on authenticated sessions without a distinct consent boundary.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The trigger list contains very broad everyday phrases like 'search online', 'research', and similar generic Chinese phrases, making accidental invocation likely. In a skill that can browse the web, configure channels, and interact with external platforms, over-broad activation increases the chance of unintended network actions or use in contexts the user did not specifically intend.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 81% confidence

Finding

The skill instructs persistent storage under ~/.agent-reach/, which establishes session persistence for downloaded data, cookies, configuration, or other artifacts across runs. In a browser-and-platform integration skill, retained state can expose account data, browsing artifacts, or tokens to later tasks or compromise if not tightly scoped and protected.

Content

Scanner excerpt · SKILL.md (reported line 28)May include surrounding context.

md

## ⚠️ Workspace Rules

**Never create files in the agent workspace.** Use `/tmp/` for temporary output and `~/.agent-reach/` for persistent data.

## Web — Any URL

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The XiaoHongShu example includes a direct content-publishing command, yet no adjacent safety notice or confirmation requirement is provided. In a skill designed to use logged-in sessions and platform cookies, this creates a clear risk of unintended public posting or account misuse.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The WeChat article section explicitly directs use of a tool described as bypassing anti-bot protections. That goes beyond normal browsing guidance and encourages circumvention of platform access controls, which can create legal/compliance risk and enable unauthorized scraping behavior from within the agent.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.