T09 · Insecure Skill Coding Practices
Error
- Location
references/api-reference.md:136- Finding
Arbitrary Local File Disclosure Through Network-Bound Payload Expansion
- Content
View full analysis
- Remediation
View remediation
Security audit
mearl
Security checks for vulnerabilities and agentic risk
Overview
This browser automation skill is mostly purpose-aligned, but it exposes logged-in browser access and an under-scoped local-file-to-network path that users should review carefully.
Install only if you trust the Mearl packages and will use it in controlled browser/test environments. Avoid using it on sensitive logged-in sessions unless necessary, do not let untrusted page content or logs drive mearl commands, and be especially careful with @file payloads, send_request, cookie copying, request rules, persistent profiles, and cloud connector tokens.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)
T08 · Insecure Dependencies
Warning
- Location
references/troubleshooting.md:20- Finding
Unpinned Package Installation and Immediate Execution of Mutable Dependencies
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Memory PoisoningPersistent Context Injection, Context Window Stuffing, Memory Manipulation
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (106)
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md 其他参数不确定时先运行 `mearl <action> --help` 或读取 [API 参数说明](./references/api-reference.md)，不要猜测字段名或类型。
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md 其他参数不确定时先运行 `mearl <action> --help` 或读取 [API 参数说明](./references/api-reference.md)，不要猜测字段名或类型。
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md 其他参数不确定时先运行 `mearl <action> --help` 或读取 [API 参数说明](./references/api-reference.md)，不要猜测字段名或类型。
Whitespace Padding
Medium
- Category
- Prompt Injection
- Confidence
- 70% confidence
- Finding
Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
- Content
md ### 📊 数据获取 | 能力 | 说明 | | ------------------------- | -------------------------------------------------------------------------------------------------------------- | | **get_requests** | 获取浏览器网络请求，支持 mtop 和普通 HTTP 请求，可按数量、关键词过滤 | | **get_logs** | 获取浏览器控制台日志，支持按级别（error / warn / info）过滤 |
Whitespace Padding
Medium
- Category
- Prompt Injection
- Confidence
- 70% confidence
- Finding
Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
- Content
md ### 📊 数据获取 | 能力 | 说明 | | ------------------------- | -------------------------------------------------------------------------------------------------------------- | | **get_requests** | 获取浏览器网络请求，支持 mtop 和普通 HTTP 请求，可按数量、关键词过滤 | | **get_logs** | 获取浏览器控制台日志，支持按级别（error / warn / info）过滤 |
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The README describes screenshot and page-data extraction features as routine capabilities without warning that captured content may include credentials, personal data, internal documents, or other sensitive on-screen information. Because this skill is specifically designed to control and inspect live browser sessions, silent capture/export of page contents is a meaningful data-exfiltration risk.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The README advertises retrieval of logged-in user information and account/session manipulation capabilities without any privacy warning, consent requirement, or data-handling constraints. In an agent skill that can reuse browser cookies and authenticated state, this materially increases the risk of unauthorized collection of personally identifiable information and account misuse.
- Content
Whitespace Padding
Medium
- Category
- Prompt Injection
- Confidence
- 70% confidence
- Finding
Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
- Content
md ### 🔧 Mock & 请求规则 | 能力 | 说明 | | ---------------- | ---------------------------------------------------------------------------------------- | | **set_mock** | 设置 API Mock 数据，支持按字段路径精确修改响应内容，也支持整体替换 | | **get_mocks** | 查看当前所有生效的 Mock 配置 |
Whitespace Padding
Medium
- Category
- Prompt Injection
- Confidence
- 70% confidence
- Finding
Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
- Content
md ### 🔧 Mock & 请求规则 | 能力 | 说明 | | ---------------- | ---------------------------------------------------------------------------------------- | | **set_mock** | 设置 API Mock 数据，支持按字段路径精确修改响应内容，也支持整体替换 | | **get_mocks** | 查看当前所有生效的 Mock 配置 |
Whitespace Padding
Medium
- Category
- Prompt Injection
- Confidence
- 70% confidence
- Finding
Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
- Content
md ### 🔧 Mock & 请求规则 | 能力 | 说明 | | ---------------- | ---------------------------------------------------------------------------------------- | | **set_mock** | 设置 API Mock 数据，支持按字段路径精确修改响应内容，也支持整体替换 | | **get_mocks** | 查看当前所有生效的 Mock 配置 |
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The README documents mock/rule/request-manipulation features, including redirecting requests, modifying headers, and blocking traffic, without warning that these actions can alter application behavior, corrupt test state, or interfere with security assumptions. In combination with authenticated browser context, these features could be abused to tamper with requests or induce unintended state-changing operations.
- Content
Context Window Stuffing
Medium
- Category
- Memory Poisoning
- Confidence
- 80% confidence
- Finding
Skill attempts to fill the context window with filler content, displacing legitimate instructions and safety constraints. This can degrade agent performance or bypass safety boundaries.
- Content
md ### 🌐 浏览器操作 | 能力 | 说明 | | ------------------ | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | **browser_list** | 统一列出普通浏览器和托管浏览器，返回默认目标、类型以及 `connected` / `running_disconnected` / `stopped` 状态 | | **browser_launch** | 启动独立 Profile 的托管 Chrome，可选择 headless、持久化 Profile、复制指定域 Cookie 或登录 TDBank 测试账号 |
Context Window Stuffing
Medium
- Category
- Memory Poisoning
- Confidence
- 80% confidence
- Finding
Skill attempts to fill the context window with filler content, displacing legitimate instructions and safety constraints. This can degrade agent performance or bypass safety boundaries.
- Content
md ### 🌐 浏览器操作 | 能力 | 说明 | | ------------------ | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | **browser_list** | 统一列出普通浏览器和托管浏览器，返回默认目标、类型以及 `connected` / `running_disconnected` / `stopped` 状态 | | **browser_launch** | 启动独立 Profile 的托管 Chrome，可选择 headless、持久化 Profile、复制指定域 Cookie 或登录 TDBank 测试账号 |
Context Window Stuffing
Medium
- Category
- Memory Poisoning
- Confidence
- 80% confidence
- Finding
Skill attempts to fill the context window with filler content, displacing legitimate instructions and safety constraints. This can degrade agent performance or bypass safety boundaries.
- Content
md ### 🌐 浏览器操作 | 能力 | 说明 | | ------------------ | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | **browser_list** | 统一列出普通浏览器和托管浏览器，返回默认目标、类型以及 `connected` / `running_disconnected` / `stopped` 状态 | | **browser_launch** | 启动独立 Profile 的托管 Chrome，可选择 headless、持久化 Profile、复制指定域 Cookie 或登录 TDBank 测试账号 |
Whitespace Padding
Medium
- Category
- Prompt Injection
- Confidence
- 70% confidence
- Finding
Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
- Content
md ### 🌐 浏览器操作 | 能力 | 说明 | | ------------------ | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | **browser_list** | 统一列出普通浏览器和托管浏览器，返回默认目标、类型以及 `connected` / `running_disconnected` / `stopped` 状态 | | **browser_launch** | 启动独立 Profile 的托管 Chrome，可选择 headless、持久化 Profile、复制指定域 Cookie 或登录 TDBank 测试账号 |
Whitespace Padding
Medium
- Category
- Prompt Injection
- Confidence
- 70% confidence
- Finding
Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
- Content
md | 能力 | 说明 | | ------------------ | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | **browser_list** | 统一列出普通浏览器和托管浏览器，返回默认目标、类型以及 `connected` / `running_disconnected` / `stopped` 状态 | | **browser_launch** | 启动独立 Profile 的托管 Chrome，可选择 headless、持久化 Profile、复制指定域 Cookie 或登录 TDBank 测试账号 | | **browser_close** | 关闭指定托管浏览器；临时 Profile 自动删除，持久化 Profile 可按需保留或删除 | | **tab_open** | 打开新标签页并等待加载完成，支持前台/后台打开、可选 `emulation` 开 tab 即移动态 |
Whitespace Padding
Medium
- Category
- Prompt Injection
- Confidence
- 70% confidence
- Finding
Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
- Content
md | 能力 | 说明 | | ------------------ | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | **browser_list** | 统一列出普通浏览器和托管浏览器，返回默认目标、类型以及 `connected` / `running_disconnected` / `stopped` 状态 | | **browser_launch** | 启动独立 Profile 的托管 Chrome，可选择 headless、持久化 Profile、复制指定域 Cookie 或登录 TDBank 测试账号 | | **browser_close** | 关闭指定托管浏览器；临时 Profile 自动删除，持久化 Profile 可按需保留或删除 | | **tab_open** | 打开新标签页并等待加载完成，支持前台/后台打开、可选 `emulation` 开 tab 即移动态 | | **tab_close** | 关闭指定标签页 |
Whitespace Padding
Medium
- Category
- Prompt Injection
- Confidence
- 70% confidence
- Finding
Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
- Content
md | ------------------ | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | **browser_list** | 统一列出普通浏览器和托管浏览器，返回默认目标、类型以及 `connected` / `running_disconnected` / `stopped` 状态 | | **browser_launch** | 启动独立 Profile 的托管 Chrome，可选择 headless、持久化 Profile、复制指定域 Cookie 或登录 TDBank 测试账号 | | **browser_close** | 关闭指定托管浏览器；临时 Profile 自动删除，持久化 Profile 可按需保留或删除 | | **tab_open** | 打开新标签页并等待加载完成，支持前台/后台打开、可选 `emulation` 开 tab 即移动态 | | **tab_close** | 关闭指定标签页 | | **tab_list** | 列出当前窗口所有标签页（ID、URL、标题、激活状态） |
Whitespace Padding
Medium
- Category
- Prompt Injection
- Confidence
- 70% confidence
- Finding
Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
- Content
md | **browser_list** | 统一列出普通浏览器和托管浏览器，返回默认目标、类型以及 `connected` / `running_disconnected` / `stopped` 状态 | | **browser_launch** | 启动独立 Profile 的托管 Chrome，可选择 headless、持久化 Profile、复制指定域 Cookie 或登录 TDBank 测试账号 | | **browser_close** | 关闭指定托管浏览器；临时 Profile 自动删除，持久化 Profile 可按需保留或删除 | | **tab_open** | 打开新标签页并等待加载完成，支持前台/后台打开、可选 `emulation` 开 tab 即移动态 | | **tab_close** | 关闭指定标签页 | | **tab_list** | 列出当前窗口所有标签页（ID、URL、标题、激活状态） | | **page_navigate** | 在当前标签页内导航到新 URL、刷新页面或沿浏览历史后退/前进，等待完成后返回 |
Whitespace Padding
Medium
- Category
- Prompt Injection
- Confidence
- 70% confidence
- Finding
Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
- Content
md | **browser_list** | 统一列出普通浏览器和托管浏览器，返回默认目标、类型以及 `connected` / `running_disconnected` / `stopped` 状态 | | **browser_launch** | 启动独立 Profile 的托管 Chrome，可选择 headless、持久化 Profile、复制指定域 Cookie 或登录 TDBank 测试账号 | | **browser_close** | 关闭指定托管浏览器；临时 Profile 自动删除，持久化 Profile 可按需保留或删除 | | **tab_open** | 打开新标签页并等待加载完成，支持前台/后台打开、可选 `emulation` 开 tab 即移动态 | | **tab_close** | 关闭指定标签页 | | **tab_list** | 列出当前窗口所有标签页（ID、URL、标题、激活状态） | | **page_navigate** | 在当前标签页内导航到新 URL、刷新页面或沿浏览历史后退/前进，等待完成后返回 |
Whitespace Padding
Medium
- Category
- Prompt Injection
- Confidence
- 70% confidence
- Finding
Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
- Content
md | **browser_launch** | 启动独立 Profile 的托管 Chrome，可选择 headless、持久化 Profile、复制指定域 Cookie 或登录 TDBank 测试账号 | | **browser_close** | 关闭指定托管浏览器；临时 Profile 自动删除，持久化 Profile 可按需保留或删除 | | **tab_open** | 打开新标签页并等待加载完成，支持前台/后台打开、可选 `emulation` 开 tab 即移动态 | | **tab_close** | 关闭指定标签页 | | **tab_list** | 列出当前窗口所有标签页（ID、URL、标题、激活状态） | | **page_navigate** | 在当前标签页内导航到新 URL、刷新页面或沿浏览历史后退/前进，等待完成后返回 | | **page_snapshot** | 获取页面无障碍树快照，支持完整树、当前视口、可交互控件或指定 CSS 子树，并返回 `@ref` 引用 |
Whitespace Padding
Medium
- Category
- Prompt Injection
- Confidence
- 70% confidence
- Finding
Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
- Content
md | **browser_close** | 关闭指定托管浏览器；临时 Profile 自动删除，持久化 Profile 可按需保留或删除 | | **tab_open** | 打开新标签页并等待加载完成，支持前台/后台打开、可选 `emulation` 开 tab 即移动态 | | **tab_close** | 关闭指定标签页 | | **tab_list** | 列出当前窗口所有标签页（ID、URL、标题、激活状态） | | **page_navigate** | 在当前标签页内导航到新 URL、刷新页面或沿浏览历史后退/前进，等待完成后返回 | | **page_snapshot** | 获取页面无障碍树快照，支持完整树、当前视口、可交互控件或指定 CSS 子树，并返回 `@ref` 引用 | | **page_click** | 点击页面元素并默认内置观察（等待页面稳定并返回高置信度信号或导航结果），按 `selector`（CSS 或 `@ref`）/ `text`（可见文本）/ `point`（视口坐标）三选一定位；`clickMode: "auto"` 在可见页按设备模拟状态派发可信 mouse/touch，隐藏页使用 DOM fallback，checkbox/radio 校验状态 |
Whitespace Padding
Medium
- Category
- Prompt Injection
- Confidence
- 70% confidence
- Finding
Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
- Content
md | **tab_open** | 打开新标签页并等待加载完成，支持前台/后台打开、可选 `emulation` 开 tab 即移动态 | | **tab_close** | 关闭指定标签页 | | **tab_list** | 列出当前窗口所有标签页（ID、URL、标题、激活状态） | | **page_navigate** | 在当前标签页内导航到新 URL、刷新页面或沿浏览历史后退/前进，等待完成后返回 | | **page_snapshot** | 获取页面无障碍树快照，支持完整树、当前视口、可交互控件或指定 CSS 子树，并返回 `@ref` 引用 | | **page_click** | 点击页面元素并默认内置观察（等待页面稳定并返回高置信度信号或导航结果），按 `selector`（CSS 或 `@ref`）/ `text`（可见文本）/ `point`（视口坐标）三选一定位；`clickMode: "auto"` 在可见页按设备模拟状态派发可信 mouse/touch，隐藏页使用 DOM fallback，checkbox/radio 校验状态 | | **page_type** | 向输入框填写文本并默认内置观察，默认先清空再输入，兼容 React 受控组件 |
Whitespace Padding
Medium
- Category
- Prompt Injection
- Confidence
- 70% confidence
- Finding
Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
- Content
md | **tab_close** | 关闭指定标签页 | | **tab_list** | 列出当前窗口所有标签页（ID、URL、标题、激活状态） | | **page_navigate** | 在当前标签页内导航到新 URL、刷新页面或沿浏览历史后退/前进，等待完成后返回 | | **page_snapshot** | 获取页面无障碍树快照，支持完整树、当前视口、可交互控件或指定 CSS 子树，并返回 `@ref` 引用 | | **page_click** | 点击页面元素并默认内置观察（等待页面稳定并返回高置信度信号或导航结果），按 `selector`（CSS 或 `@ref`）/ `text`（可见文本）/ `point`（视口坐标）三选一定位；`clickMode: "auto"` 在可见页按设备模拟状态派发可信 mouse/touch，隐藏页使用 DOM fallback，checkbox/radio 校验状态 | | **page_type** | 向输入框填写文本并默认内置观察，默认先清空再输入，兼容 React 受控组件 | | **page_press** | 按下键盘按键并默认内置观察（Enter / Tab / Escape / Space 等），支持 Ctrl / Shift / Alt / Meta 组合键 |
Whitespace Padding
Medium
- Category
- Prompt Injection
- Confidence
- 70% confidence
- Finding
Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
- Content
md | **page_navigate** | 在当前标签页内导航到新 URL、刷新页面或沿浏览历史后退/前进，等待完成后返回 | | **page_snapshot** | 获取页面无障碍树快照，支持完整树、当前视口、可交互控件或指定 CSS 子树，并返回 `@ref` 引用 | | **page_click** | 点击页面元素并默认内置观察（等待页面稳定并返回高置信度信号或导航结果），按 `selector`（CSS 或 `@ref`）/ `text`（可见文本）/ `point`（视口坐标）三选一定位；`clickMode: "auto"` 在可见页按设备模拟状态派发可信 mouse/touch，隐藏页使用 DOM fallback，checkbox/radio 校验状态 | | **page_type** | 向输入框填写文本并默认内置观察，默认先清空再输入，兼容 React 受控组件 | | **page_press** | 按下键盘按键并默认内置观察（Enter / Tab / Escape / Space 等），支持 Ctrl / Shift / Alt / Meta 组合键 | | **page_scroll** | 滚动页面或指定容器并默认内置观察，支持 up / down / top / bottom 四个方向，可自定义滚动距离；容器支持 CSS selector 或 `@ref` | | **page_wait** | 等待指定毫秒数，或等待某个 CSS 选择器对应的元素出现（支持超时设置） |
Static analysis
No suspicious patterns detected.