Security audit

豆包自动化操作

Security checks for vulnerabilities and agentic risk

Overview

This skill does what it says, but it takes broad control of a logged-in Edge browser profile and can disrupt or expose normal browsing sessions.

Install only if you are comfortable letting this skill close and control your logged-in Edge browser through CDP. Prefer using a separate Edge profile with only Doubao logged in, close sensitive tabs first, and review any local image path before running image-to-video because that file will be sent to Doubao.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (8)

Description-Behavior Mismatch

Medium

Confidence: 85% confidence
Finding: The script implements local image upload automation via input[type=file] and setInputFiles, which expands capability beyond the manifest’s stated browser automation scope and causes local data to be transmitted to a remote service. This is dangerous because users may invoke the skill expecting Doubao operations only, while the code can exfiltrate arbitrary local files selected through arguments without an explicit consent boundary.

Context-Inappropriate Capability

Medium

Confidence: 95% confidence
Finding: The code attaches to an already logged-in Edge instance over CDP and reuses the first available browser context, inheriting that session’s cookies, authentication state, and potentially access to unrelated tabs. This is dangerous because compromise or misuse of the skill gives it broad control over a user’s live browser session, exceeding the narrow task of operating Doubao and increasing the blast radius to other sites and data in that profile.

Context-Inappropriate Capability

Medium

Confidence: 91% confidence
Finding: The script starts Edge with a remote debugging port and then attaches Playwright to the user's live browser context, using the existing profile directory. That grants broad access to authenticated sessions, cookies, open tabs, and page content beyond Doubao, so compromise or misuse of the script could act with the user's browser identity across sites.

Context-Inappropriate Capability

Medium

Confidence: 96% confidence
Finding: The script forcibly terminates all running Edge processes with Stop-Process -Force before launching a CDP-enabled instance. In the context of a browser automation skill that explicitly takes over an already logged-in browser profile, this can disrupt unrelated user activity, cause data loss in open tabs or forms, and unexpectedly seize control of authenticated sessions.

Vague Triggers

Medium

Confidence: 88% confidence
Finding: The trigger phrase '帮我操作豆包做 XXX' is overly broad and could activate the skill for loosely related or high-risk requests, causing unintended browser automation in a logged-in session. In this context, the skill takes over a real authenticated Edge profile via CDP, so accidental invocation can have meaningful consequences including sending prompts, downloading content, or interacting with account state.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The instructions tell users to force-kill all Edge processes with taskkill /F, which can terminate active browsing sessions, discard unsaved form data, and interrupt unrelated work. Because this skill is designed to reuse the user's normal Edge profile and login state, the operational guidance directly affects a real personal browser environment, increasing the chance of disruptive or unsafe behavior.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The script uploads a local file to the remote Doubao service using setInputFiles without any explicit user-facing notice that the selected file leaves the local machine. This is dangerous because sensitive local images may be transmitted to a third-party service unintentionally, creating privacy and data handling risks.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: Launching Edge against the user's existing profile without a clear warning or consent flow exposes sensitive browser session data to the automation code. In this skill's context, the whole design depends on taking over an already logged-in browser, which materially increases the risk of unauthorized access to Doubao and any other active sessions in that profile.

Static analysis

Detected: suspicious.dangerous_exec

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: scripts/doubao-batch-gen.js:62