blogger-auto-follow

• Outcome: Pass
• Latest audit: Aug 19, 2026 · 5:45 AM UTC
• Version: 0.1.2

Overview

The skill performs confirmed, visible-browser social follow batches and keeps local records as disclosed, but users should understand it reuses platform login profiles and stores a local followed-account archive.

Install only if you are comfortable with a tool that can follow accounts from your logged-in platform session after confirmation. Review every batch before typing the confirmation phrase, use the dedicated browser profile intentionally, and delete data/browser_profiles plus local result/archive files if you do not want retained login state or followed-account history. Treat the manager's bulk-open function as trusted-URL-only because it opens stored profile links in your browser.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (16)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 88% confidence
• Finding: The skill invokes file read, file write, and network-capable browser automation, but the skill metadata does not declare any permissions or capability boundaries in a machine-readable way. This creates a transparency and governance gap: an agent or reviewer may underestimate what the skill can access or persist, increasing the chance of unintended data exposure or unsafe execution.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 92% confidence
• Finding: The documented purpose is limited to extracting a candidate list and performing confirmed batch follows, but the described/observed behavior expands into persistent local asset management, cross-platform archival, generated navigation documents, manual add/delete/list functions, and opening archived profiles in the default browser. This broader behavior materially increases data collection, retention, and external-action scope beyond the user-facing description, which can mislead users and reviewers and enable unintended privacy or account-risk impacts.

Description-Behavior Mismatch

Medium

• Confidence: 92% confidence
• Finding: The file describes a persistent cross-industry 'asset library' with update timestamps, archive counts, and navigation for later reuse, which goes beyond the skill’s declared one-time workflow of organizing candidates and executing a single user-confirmed follow batch. This expands the skill into ongoing account tracking and reusable targeting infrastructure, increasing the chance of unauthorized repeated actions or scope creep beyond the user’s immediate request.

Context-Inappropriate Capability

Medium

• Confidence: 90% confidence
• Finding: The file claims support for cross-platform collection, direct homepage navigation, and ongoing 'latest dynamic' tracking, which is broader than the stated purpose of following a fixed list on a single platform after one explicit confirmation. In this context, the extra monitoring and cross-platform aggregation capability creates unnecessary surveillance and growth-of-scope risk.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The body of the file stores a historical ledger of followed accounts, fan counts, follow groups, timestamps, status markers, and direct profile links. That persistent operational dataset is not required for a one-time confirmed batch-follow task and can be repurposed for repeated mass engagement, profiling, or automated targeting beyond the user’s original authorization.

Context-Inappropriate Capability

Medium

• Confidence: 94% confidence
• Finding: The embedded management commands enable opening tracked feeds by industry and launching grouped blogger operations, adding account-management and monitoring features beyond the manifest’s narrow batch-follow scenario. These commands make the skill more operationally capable than advertised and could facilitate ongoing coordinated follow/monitor workflows.

Description-Behavior Mismatch

Medium

• Confidence: 90% confidence
• Finding: The file contains a persistent, prebuilt list of already-followed accounts across Douyin and Bilibili, including grouping and status metadata, which materially expands the skill from a user-driven one-time follow executor into a stateful account-targeting system. In the context of a browser automation skill that can batch-follow accounts, this creates risk of unauthorized or insufficiently user-scoped actions, especially if future runs reuse the stored list without the user explicitly reselecting each target.

Description-Behavior Mismatch

Medium

• Confidence: 92% confidence
• Finding: The script initializes a local BloggerDB and writes followed-account metadata such as name, industry, platform, profile URL, unique ID, category, fans, bio, and follow status after successful or already-followed actions. That persistence extends beyond the stated batch-follow execution role and creates a retained dataset of user actions and third-party profiles, which increases privacy, data minimization, and scope-creep risk if the storage is not clearly disclosed, bounded, and protected.

Description-Behavior Mismatch

High

• Confidence: 94% confidence
• Finding: This code performs persistent database mutation and local file export operations that materially exceed the skill’s declared purpose of organizing user-provided candidates and then executing a single confirmed batch-follow action on a fixed list. Capability drift is dangerous in agent skills because a caller may invoke undocumented add/delete/export behaviors to silently alter long-lived state, broaden targeting, or repurpose the skill as a general asset-management tool without the tighter confirmations and scope limits described in the manifest.

Description-Behavior Mismatch

Medium

• Confidence: 90% confidence
• Finding: The script opens arbitrary stored profile URLs in the local default browser for 'dynamic inspection,' which is outside the described fixed-list confirmed follow flow and can cause unreviewed navigation on the user’s machine. If the database contains attacker-controlled or unvalidated URLs, this behavior can drive the browser to phishing, tracking, or harmful sites and expands the skill from constrained follow automation into general external link launching.

Intent-Code Divergence

Medium

• Confidence: 82% confidence
• Finding: The module documentation explicitly describes an industry-wide asset management and dynamic retrieval tool, which conflicts with the much narrower manifest. In the agent setting, this mismatch is security-relevant because documentation often signals intended broader use and can mask capability expansion, making it easier for operators or downstream components to invoke actions beyond the user-consented scope.

Description-Behavior Mismatch

Medium

• Confidence: 90% confidence
• Finding: This module creates persistent local storage and a generated Markdown navigation file for followed bloggers, which materially exceeds the manifest’s described one-time candidate整理 and confirmed batch-follow workflow. In this skill context, retaining cross-platform identity, profile URLs, bios, and follow history increases privacy and scope-creep risk because users may not expect durable profiling or asset tracking from a follow-execution helper.

Intent-Code Divergence

Medium

• Confidence: 87% confidence
• Finding: The module docstring openly describes a broader persistent ‘asset database’ with deletion and handbook generation than the skill metadata advertises. In security terms, this is a capability-transparency failure: users may authorize a narrow follow action while the implementation supports long-term collection, organization, and reuse of creator data across platforms.

Missing User Warnings

Medium

• Confidence: 87% confidence
• Finding: This code performs the actual follow-button click immediately once a matching account card is found, and there is no local confirmation gate, warning, or policy check at the point of action. In the context of a bulk-follow automation skill, this increases the risk of unintended social actions if upstream confirmation logic is missing, bypassed, or called incorrectly, because the adapter itself has no defense-in-depth against accidental or abusive mass follows.

Missing User Warnings

Medium

• Confidence: 84% confidence
• Finding: The delete_blogger function irreversibly removes records and renumbers IDs without any built-in confirmation, soft-delete, or recovery mechanism. In a skill that maintains persistent local archives, accidental or unauthorized deletion can destroy audit/history data and make later reconciliation harder because record identifiers are reassigned.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

playwright>=1.40.0

• Confidence: 95% confidence
• Finding: The dependency specifier uses a lower-bound only constraint (playwright>=1.40.0), which permits installation of any future major or minor release. This can introduce supply-chain risk and non-deterministic builds, since later versions may contain breaking changes or newly introduced vulnerabilities that are pulled in without review.

VirusTotal

65/65 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.