Security audit

X Article Reader

Security checks for vulnerabilities and agentic risk

Overview

The skill appears intended to read X articles aloud, but it stores an X login session locally and uses it in a browser with weak scoping and browser sandboxing disabled.

Review before installing. Use only with X article URLs you trust, understand that it stores reusable X session data under the skill directory, and avoid sharing or backing up that directory. Prefer a version that validates x.com article URLs, removes --no-sandbox, avoids writing plaintext state.json, pins dependencies, and documents cleanup of saved login state.

A.I.G

Vulnerability Patterns

Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions

Findings (4)

T09 · Insecure Skill Coding Practices

Error

Location: scripts/read_article.py:69
Finding: Chromium Sandbox Disabled for Untrusted Web Content
Content: View full analysis
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Warning

Location: scripts/read_article.py:47
Finding: Missing URL Allowlist Permits Navigation Outside the Declared X Article Scope
Content: View full analysis
dict: try: from patchright.sync_api import sync_playwright except ImportError: print("❌ patchright 未安装，请运行：") print(" pip install patchright") print(" python3 -m patchright install chromium") sys.exit(1) if not BROWSER_PROFILE_DIR.exists(): print("❌ 未找到认证数据，请先运行：") print(f" cd {SKILL_DIR}/scripts") print(" python3 auth_setup.py") sys.exit(1) print(f"🌐 正在加载文章...") print(f" {url}") playwright = sync_playwright().start() context = None try: context = playwright.chromium.launch_persistent_context( user_data_dir=str(BROWSER_PROFILE_DIR), headless=headless, args=["--no-sandbox", "--disable-blink-features=AutomationControlled"], ) page = context.new_page() page.goto(url, wait_until="domcontentloaded", timeout=30000) ``` The URL is accepted from the command line without validation: ```python parser.add_argument("url", help="X Article URL") ``` ### Technical Analysis Although the argument is documented as an X Article URL, the implementation does not validate the URL scheme, hostname, port, or path before passing it to `page.goto`. As a result, the authenticated persistent browser can be directed to attacker-controlled websites or HTTP services reachable from the user's machine. The implementation also does not verify the final URL after redirects, so an initially approved-looking URL could redirect outside the intended domain. This violates the declared X-article-only trust boundary. The risk is amplified by the use of an authenticated persistent profile and the disabled Chromium san ...[truncated 1137 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/auth_setup.py:73
Finding: Authenticated Browser State Written to an Unprotected Plaintext File
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: SKILL.md:27
Finding: Unpinned Third-Party Package and Browser Installation
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Behavioral ASTexec() Call, eval() Call, Dynamic Import
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (9)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The declared purpose focuses on reading an article aloud, but the documented behavior also includes authentication setup, persistent session storage, and browser-driven login management. That mismatch is dangerous because users or agent frameworks may authorize the skill for simple TTS while unknowingly granting access to account sessions and login flows, increasing credential and privacy risk.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 94% confidence
Finding: The skill documentation describes capabilities that imply shell execution, file reads/writes, browser automation, and persistent local storage, but it declares no explicit tool scope or permission boundary. That increases the chance an agent may invoke powerful operations without clear user-visible restriction or review, especially because the skill launches scripts and stores browser state.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The trigger phrases include broad commands like '读出来', '朗读', and 'read aloud', which are common everyday requests and may cause unintended activation. In context, unintended activation is more concerning because this skill can open URLs, run scripts, and potentially reuse authenticated browser state, so a casual utterance could trigger more powerful behavior than expected.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The file’s user-facing docstring and runtime messages are written entirely in Chinese, which imposes a specific language on users without opt-in or alternative language support. This is a natural-language policy concern because the skill does not offer any language/locale choice or explain that it is intentionally region-specific.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The script launches a persistent browser context, has the user log into X, and then saves both the browser profile and storage state locally. That creates reusable authenticated session material for an account, which is more sensitive than what is necessary for a simple text-to-speech reader unless the need for authenticated access is explicitly justified and tightly scoped. In this skill context, reading articles aloud does not obviously require long-lived account session persistence, so the capability increases the risk of credential/session misuse if the local files are accessed by other code or users on the system.
Content: No source excerpt is available for this finding.

subprocess module call

Medium

Category: Dangerous Code Execution
Confidence: 70% confidence
Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.
Content: Scanner excerpt · scripts/read_article.py (reported line 161)May include surrounding context.
python
cmd.append(content) try: subprocess.run(cmd, check=True) print(f"\n✅ {'音频已保存：' + output_file if output_file else '朗读完毕'}") except KeyboardInterrupt: print("\n⏹️ 已停止")

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 84% confidence
Finding: The file states that the skill automatically detects Chinese vs English and picks the appropriate voice, and later maps Chinese to Tingting and English to Samantha. This imposes a locale/language behavior by default rather than offering a user language or voice preference as an opt-in.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Low

Category: Not specified by scanner
Confidence: 80% confidence
Finding: The documentation states the authentication data is fully isolated from other skills, but the implementation only writes files under a local directory and does not enforce any OS-level isolation, access controls, or sandboxing. This can mislead users into overtrusting the storage model and underestimating the exposure of saved session data if other local processes or skills can read the same filesystem location.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 86% confidence
Finding: The code automatically classifies text as Chinese or English and then selects a corresponding voice, while the file-level documentation and output messages are also fixed in Chinese. This imposes a language/locale choice by default rather than explicitly asking the user for their preferred language or narration locale.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.