aicloud-thought-proxy

• Outcome: Review
• Latest audit: Aug 11, 2026 · 9:55 AM UTC
• Version: 0.1.0

Overview

This skill is review-worthy because it can control logged-in browser sessions, install browser-control tools, and relay user requests and execution results to third-party AI sites with limited privacy safeguards.

Install only if you intentionally want a local agent to drive your browser and use logged-in web AI accounts. Use a dedicated browser profile or account, avoid sending secrets or private files, confirm each relay carefully, and remove the browser-control extension, MCP config, and installed drivers when finished.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (11)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 81% confidence
• Finding: The skill explicitly directs the agent to run local scripts, shell commands, installers, and browser automation tooling, but it does not declare corresponding permissions. That mismatch weakens policy enforcement and informed consent because a reviewer or runtime may not realize the skill can execute commands and inspect environment state.

Vague Triggers

Medium

• Confidence: 87% confidence
• Finding: The README documents activation examples that are broad and natural-language based, including generic phrases like using a browser to open an AI website and collaborate or save tokens. In an agent skill system, loose trigger boundaries can cause accidental invocation in unrelated contexts, leading the agent to open external web AIs, relay user content, and begin a browser-automation workflow without sufficiently explicit user intent.

Vague Triggers

Medium

• Confidence: 78% confidence
• Finding: The top-level description contains very broad trigger language such as using a browser to open an AI website, collaborate, or save tokens. This can cause the skill to activate for ordinary browsing or assistance requests, unexpectedly routing the conversation into a browser-mediated third-party AI workflow.

Vague Triggers

Medium

• Confidence: 84% confidence
• Finding: The trigger section repeats ambiguous activation criteria like '网页版 AI', '节省 tokens', and delegating planning to another AI, without strong exclusions or confirmation requirements. In context, this is more dangerous because activation leads directly to browser automation and sharing prompts/results with external services.

Missing User Warnings

High

• Confidence: 95% confidence
• Finding: The overview says the local agent and web AI will collaborate, but it does not clearly warn that user requests, local task details, outputs, and possibly sensitive data may be transmitted to third-party web AI providers. This undermines informed consent and creates a significant privacy risk, especially because the skill is designed to externalize reasoning to consumer web services.

Missing User Warnings

High

• Confidence: 98% confidence
• Finding: The collaboration protocol instructs the agent to tell the web AI it can perform local actions and then relay user requirements and execution results back and forth. That creates a direct external disclosure path for system context, code, logs, file contents, and other potentially sensitive material without an explicit warning and consent checkpoint tied to each category of data.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The document explicitly recommends controlling a user's already-open Chrome instance because it preserves login state and personal configuration, but it does not pair that guidance with a clear privacy warning or strict consent boundary. In this skill's context, that means the agent may gain access to authenticated AI chats, cookies, saved data, open tabs, and other sensitive browser content well beyond the user's immediate task, increasing the risk of unauthorized data exposure or misuse.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The fallback guidance instructs operators to connect to an existing browser instance via remote debugging or reuse the user's profile directory specifically to preserve login state, again without a prominent warning about privacy, persistence, and local system access risks. This is especially dangerous because remote debugging/profile reuse can expose far more than a single website session, including browsing history, saved sessions, and potentially broader browser-controlled capabilities.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The document explicitly instructs reuse of the user's Firefox profile to preserve login state, which exposes all cookies, stored sessions, browsing data, and potentially saved credentials to the automation context. In this skill's context—automating web AI sites and reading page contents—profile reuse materially increases the chance of unintended access to unrelated accounts or leakage of sensitive session data beyond the target site.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The document instructs users to install and connect a browser-control extension, then explicitly states the agent will be able to control the user's browser, but it does not present a clear upfront warning about the breadth of access to page contents, sessions, and sensitive data. In this skill's context—driving logged-in web AI sessions in the user's real browser—omitting a privacy/data-access warning materially increases the risk of users authorizing powerful browser access without informed consent.

Ssd 3

High

• Confidence: 99% confidence
• Finding: The skill explicitly says to forward the user's requests in full and send execution results, errors, and outputs to a third-party web AI. This is a plain-language exfiltration channel by design; in this context it is especially risky because the same skill also performs local execution, downloads, searches, and file operations, so highly sensitive local data can easily be propagated outside the trusted environment.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.