Security audit

豆包自动化操作

Security checks for vulnerabilities and agentic risk

Overview

This skill does what it says, but it controls the user's normal logged-in Edge browser too broadly and can disrupt or expose unrelated browser sessions.

Install only if you are comfortable letting the skill control a logged-in Edge profile. Prefer using a separate Edge profile dedicated to Doubao, close unrelated browser sessions first, avoid sensitive prompt files or image uploads, and do not leave the CDP-enabled browser running after use.

A.I.G

Vulnerability Patterns

Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Error

Location: scripts/doubao-batch-gen.js:57
Finding: Shell Command Injection Through the LOCALAPPDATA Environment Variable
Content: View full analysis
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Warning

Location: scripts/start-edge-cdp.ps1:76
Finding: Authenticated Daily Browser Profile Exposed Through Broad CDP Control
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (10)

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 84% confidence
Finding: The skill describes automation that uses environment-dependent local paths, browser profiles, and debugging endpoints, but it declares no explicit tool scope or permissions boundary. In practice this can cause the agent to invoke local execution and access sensitive user context without an upfront capability declaration, increasing the chance of overbroad access and unsafe execution.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The core design intentionally reuses the user's real Edge profile and logged-in Doubao session via CDP, giving the automation access to cookies, account state, and potentially other browser data in that profile. This makes the skill substantially more dangerous than ordinary web automation because any mis-trigger, prompt injection, or script flaw operates with the user's live authenticated context.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The trigger phrases include broad language such as '帮我操作豆包做 XXX', which can match ordinary conversational requests and invoke a high-impact automation skill unexpectedly. Because this skill can take over a logged-in browser session and perform account actions, accidental triggering materially raises the risk of unintended actions, privacy exposure, or downloads.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The instructions direct the user or agent to force-kill all Edge processes with taskkill /F, which can terminate unrelated browsing sessions, discard unsaved work, and interrupt security-sensitive flows. In the context of an agent skill, this is especially dangerous because the action affects the user's primary browser globally rather than an isolated automation instance.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The script can upload a local file to a third-party web service and download remote content onto the local filesystem, but it provides no explicit user-facing confirmation, path safety checks, or trust warning before doing so. In an agent-skill context, that matters because a higher-level agent could trigger these actions with user-provided or model-generated parameters, causing unintended disclosure of local files or silent writes of untrusted content to disk.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The script starts Edge with a remote debugging port and explicitly points at the user's real Edge profile directory, then attaches via CDP. That gives the automation access to the user's authenticated browser state, cookies, open pages, and potentially other sensitive session data without an explicit consent or warning boundary, which is dangerous if the skill is misused or invoked unexpectedly.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The script navigates to doubao.com and later submits prompt contents from a local file to that external service. In this skill context, transmitting prompts is part of the intended functionality, but the lack of an explicit privacy notice or validation increases the risk that users unknowingly send sensitive local data, proprietary prompts, or personal information to a third party.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The script unconditionally kills all running msedge processes with Stop-Process -Force before starting a debug-enabled instance. This disrupts unrelated browsing sessions, can cause loss of unsaved browser state or downloads, and widens impact beyond the stated Doubao automation task. In this skill's context, taking over an already logged-in browser makes this more sensitive because it manipulates the user's real profile and active session rather than an isolated automation profile.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The script forcefully terminates every running Edge process without any confirmation or opportunity to cancel, which is an unsafe destructive action. This can abruptly end unrelated work and interfere with the user's authenticated browser environment; in a skill designed to control a logged-in browser via CDP, the lack of consent and isolation makes the behavior more dangerous.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 95% confidence
Finding: Natural-language strings in the file, including the description, usage examples, prompts, selectors, and console output, are all Chinese with no option for the user to choose another language. Under the stated policy, forcing a specific language without opt-in is a locale/language policy violation.
Content: No source excerpt is available for this finding.

Static analysis

Detected: suspicious.dangerous_exec

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: scripts/doubao-batch-gen.js:62