T09 · Insecure Skill Coding Practices
Error
- Location
scripts/collect.js:27- Finding
Persistent authenticated browser state may be included in packaged Skill archives
- Content
View full analysis
- Remediation
View remediation
Security audit
GEO品牌诊断
Security checks for vulnerabilities and agentic risk
Overview
The skill mostly does what it says, but it stores reusable login sessions inside the skill directory and includes packaging code that could archive those sessions.
Review before installing. Use a dedicated or disposable browser profile and non-sensitive test accounts, do not package or share the skill after logging in unless the profile directory is removed, and avoid running it with administrator privileges. Treat generated report paths carefully because brand names are not sanitized.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (3)
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/collect.js:23- Finding
Unsanitized brand argument allows report output path traversal
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/collect.js:273- Finding
Chromium sandbox is disabled while processing external web content
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Behavioral ASTexec() Call, eval() Call, Dynamic Import
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (15)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The declared description is for a diagnostic tool that gathers recommendation information from three AI platforms and produces a report. The supplied code does none of that: it is a build/packaging utility for creating a .skill archive from a local directory. It interacts only with the local filesystem and PowerShell, with no evidence of platform data collection, recommendation analysis, or report generation. This is a materially different primary purpose, so it is a clear mismatch.
- Content
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md node scripts/collect.js <品牌> <行业> <城市> [场景数]
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md node scripts/collect.js <品牌> <行业> <城市> [场景数]
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md node scripts/collect.js <品牌> <行业> <城市> [场景数]
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md node scripts/collect.js <品牌> <行业> <城市> [场景数]
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md node scripts/collect.js <品牌> <行业> <城市> [场景数]
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The trigger phrase set is broad and can cause the skill to activate on vague GEO/diagnosis requests without confirming user intent, brand target, or data-collection consent boundaries. In a skill that automates browser-based collection across logged-in third-party platforms, overbroad activation increases the chance of unintended use and unnecessary exposure of authenticated session context.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The skill explicitly states that subsequent runs automatically reuse login state across Doubao, Yuanbao, and Tongyi, but it does not warn users about the privacy and security implications of persistent authenticated sessions. Reusing stored sessions can expose account context, retained cookies, and cross-run data access if the environment is shared or compromised.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The script launches a persistent Chrome profile in a local '.chrome-profile' directory and explicitly tells the user that login state will be remembered for reuse. That means authentication cookies, tokens, and browsing/session artifacts are stored on disk, which can expose user accounts if the machine, repository directory, or generated artifacts are accessed by another user or process. In this skill context, the tool logs into third-party AI platforms, so the persisted profile may contain valuable authenticated sessions across multiple services.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The document formats dates with toLocaleDateString('zh-CN'), which forces a specific locale in generated user-facing content. Under the policy, fixed language or locale behavior should either offer user choice or be clearly documented as a justified region-specific constraint.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The generated footer uses toLocaleString('zh-CN') and Chinese fixed text, which enforces a specific language/locale for report output. This is a natural-language policy concern unless the skill explicitly offers language selection or clearly limits itself to a Chinese-only context.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
This code deletes existing output archives with fs.unlinkSync and invokes PowerShell via execSync, but the only visible messages are success/failure logs after or around execution rather than advance disclosure or confirmation. For a packaging script, destructive overwrite/delete behavior and subprocess execution should be explicitly disclosed to the user in code comments, prompts, or accompanying documentation.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 86% confidence
- Finding
The script formats the report timestamp with
toLocaleString('zh-CN'), which forces a specific locale in output. There is no user opt-in or documented justification that this skill is strictly limited to Chinese-language operation.- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 80% confidence
- Finding
This code derives an output path, generates a DOCX buffer, and writes the file to disk using fs.writeFileSync. Although it logs the resulting filename after the write, there is no warning beforehand or other disclosure in this file that a new document will be created automatically.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The success and error messages are emitted only in Chinese (e.g. '打包成功' and '打包失败'), which imposes a specific language on users without opt-in. This is a natural-language policy concern because the file provides no documented reason for a Chinese-only locale or any mechanism to select another language.
- Content