Back to skill

Security audit

Auto Tech Research

Security checks for vulnerabilities and agentic risk

Overview

This skill needs review because it claims to gather real web research, but its included script fabricates source lists and saves reports without strong safeguards.

Do not rely on this skill's generated reports as real research evidence unless the retrieval path is fixed and every source has verifiable provenance. If installed for experimentation, use an isolated browser profile, avoid confidential topics or private links, review any generated files, and require explicit confirmation before authenticated browsing or file writes.

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

other

Warning
Location
scripts/auto-research.py:290
Finding

Synthetic Research Results Are Presented as Successfully Retrieved Platform Data

Content
View full analysis
List[ContentItem]: """Multi-platform parallel search""" results = [] # Sort by relevance and search high-relevance platforms first sorted_configs = sorted(platform_configs, key=lambda x: x['score'], reverse=True) for cfg in sorted_configs: platform = cfg['name'] count = cfg['fetch_count'] lang = "zh" if platform in ["Zhihu", "CSDN", "Juejin", "Bilibili", "Xiaoyuzhou", "WeChat"] else "en" items = self._simulate_search(platform, keywords[lang], count) results.extend(items) # Update statistics stats = self.platform_stats[platform] stats.fetched_count = len(items) print(f" ✓ {platform}: {len(items)} items") return results def _simulate_search(self, platform: str, keywords: Dict, count: int) -> List[ContentItem]: """Simulate search results (a real API should be called in production)""" items = [] core_word = keywords["core"][0] # Platform-specific fixed title templates are selected here. template_list = templates.get(platform, [f"{core_word} content"]) for i in range(min(count, len(template_list) * 3)): title = template_list[i % len(template_list)] level = self.classifier.classify_level(title) content_type = self.classifier.classify_type(platform) item = ContentItem( title=title, url=f"https://example.com/{platform.lower()}/{i}", platform=platform, content_type=content_type, language="zh" if platform in ["Zhihu", "CSDN", "Juejin", "Bilibili", "Xiaoyuzhou", "WeChat"] else "en", level=level, quality_score=round(0.7 + (i % ...[truncated 2962 chars]
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Note
Location
scripts/auto-research.py:636
Finding

Unsanitized Topic Input Is Incorporated into the Report Output Path

Content
View full analysis
Remediation
View remediation
Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (27)

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

The skill appears to materially misrepresent its behavior: it claims live browser-based research and HTML reporting, but the finding indicates the actual implementation uses local template generation without real browsing or transparent diagnostics. This is dangerous because users may rely on fabricated or unverifiable results as if they were grounded in real external sources, undermining integrity and potentially masking other unsafe behavior.

Content

No source excerpt is available for this finding.

Hidden Instructions

High
Category
Prompt Injection
Confidence
70% confidence
Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · references/report-template.html (reported line 151)May include surrounding context.

html
<div class="container">

  <!-- 技术概览 -->
  <section id="overview">
    <h2>📋 技术概览</h2>
    <div class="overview-content">

Description-Behavior Mismatch

High
Category
Not specified by scanner
Confidence
99% confidence
Finding

The skill metadata promises real browser/CDP-driven research across live platforms, but the implementation fabricates results via _simulate_search using hard-coded titles, fake URLs, synthetic summaries, and current timestamps. In a research skill, this is dangerous because downstream users may trust the output as real-world evidence and make technical, business, or security decisions based on invented sources.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
77% confidence
Finding

The file title and nearly all user-facing examples and output structures are presented in Chinese, including the canonical input phrase shown in the architecture diagram. There is no explicit user choice for language or a documented reason that the skill is intentionally locale-specific, which can violate language/locale policy expectations.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The skill is designed for broad multi-platform searches across domestic and international services using browser automation, but the overview lacks a clear privacy/network warning. That omission can cause users to unknowingly send sensitive research topics, organization names, or internal project terms to third-party services, creating privacy leakage and operational-security risk.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The manifest says the skill outputs 'HTML 格式的结构化调研报告', but this file repeatedly documents the generated report as Markdown, including an explicit Markdown template and a data flow ending in 'Markdown报告'. That is a direct description-behavior mismatch at the skill-design level rather than an implementation detail.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The overview describes retrieving external content, checking links, backing up important material, and producing output files without clearly warning users about network access, local file writes, retention, or possible copying of third-party content. In a browser-automation skill that searches many external platforms, silent data handling increases privacy, compliance, and unintended persistence risks, especially if user-provided topics contain sensitive internal terms.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
84% confidence
Finding

The manifest's core principle explicitly says not to use web_fetch and to rely on browser/CDP interactions that mimic human search behavior. This overview, however, gives an extension example using 'api.search(keywords)', which indicates a non-browser retrieval mode inconsistent with the stated browser-only operational model.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The README describes the skill entirely in Chinese and frames the generated research workflow and outputs around Chinese-language usage, while not indicating that users can choose another language. Under the stated policy, forcing a specific language without opt-in is a natural-language policy concern unless the locale constraint is explicitly documented and justified.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The trigger phrases are very broad, natural-language requests that can easily match ordinary user conversation and invoke the skill unintentionally. In a skill that drives a browser, performs multi-platform searches, and generates reports, accidental activation can cause unintended browsing activity, data collection, and downstream file creation without clear user intent.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The README states that a report is automatically generated and saved to disk, but it does not warn users about local file creation or describe where outputs go, naming behavior, or overwrite safeguards. In an automated browsing/research skill, silent persistence can leak sensitive search topics, clutter the filesystem, or overwrite existing files if path handling is unsafe in the implementation.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
82% confidence
Finding

The skill declares no explicit tool scope while the analyzer detected file-writing capability, which creates unnecessary ambiguity about what the skill may do at runtime. In an agent environment, missing permission boundaries can enable unintended file creation or overwrite behavior, especially when the skill also claims broad automation and report generation.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill instructs use of the user's logged-in Chrome profile (chrome-relay) to access content, but does not clearly warn about the privacy and account-security implications. Reusing an authenticated browser context can expose private account data, session-bound content, browsing state, or cause actions to be attributed to the user on third-party platforms.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The manifest repeatedly states that v4.0 fully abandons web_fetch and uses browser/CDP as the sole mechanism for search and extraction. However, the GitHub diagnostic line explicitly says '仓库搜索+API', which contradicts the stated browser-only approach and indicates a different retrieval method than the documented intent.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The skill automatically opens and snapshots user-supplied links without an explicit warning that external sites will be contacted and their contents processed. This can leak user intent to third-party sites, trigger tracking or authenticated page access, and unexpectedly ingest sensitive content from private or semi-private URLs.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The file's title and all instructional content are in Chinese, and there is no statement offering users an alternate language or clarifying that the guide is intentionally limited to Chinese-speaking users. Under the policy for natural-language issues, forcing a specific language without user opt-in is a reportable locale-policy concern.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The HTML root sets lang="zh-CN", which hard-codes the document language/locale to Simplified Chinese. Under the policy criteria, forcing a specific language without user opt-in or a documented justification is a natural-language policy violation.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

The manifest explicitly states '不使用 web_fetch,全程使用 browser(CDP 协议)', but the inline diagnostic example text says 'web_fetch API 成功', 'web_fetch 403', and 'web_fetch 返回空'. Because this file is a report template intended to represent how the skill operates, these comments/example outputs actively contradict the documented browser-only intent rather than merely omitting detail.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

This markdown template is written entirely in Chinese and defines report headings, labels, and narrative placeholders in Chinese, effectively constraining generated output to a specific language. The file does not offer a language choice or explain a justified region-specific requirement, which matches the language/locale policy violation criteria.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

This markdown file is entirely written in Chinese and presents the generated report as a fixed-format output, with no indication that users can choose another language or locale. Under the policy, forcing a specific language without opt-in is a natural-language policy violation unless the locale constraint is clearly documented and justified.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The script’s natural-language interface and generated report content are hard-coded in Chinese, beginning with the module description and continuing throughout user-facing behavior. This creates a locale/language policy issue because the skill does not offer opt-in or any alternative language selection.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The inline comment explicitly states the function should call a real API, yet the code only simulates content. This discrepancy increases the risk that maintainers, reviewers, or operators will misunderstand the behavior and deploy the skill believing it performs authentic collection when it does not.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The technical overview template emitted into the final report is entirely in Chinese and is always used regardless of user preference or topic language. Forcing a specific output language without giving the user a choice matches the language/locale policy violation criteria.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The skill description promises HTML structured output, but the implementation generates and saves Markdown instead. This is primarily an integrity and contract-mismatch issue: consumers expecting HTML may mis-handle the output, skip sanitization assumptions, or fail integrations built around the declared format.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low
Category
Not specified by scanner
Confidence
72% confidence
Finding

The file presents the skill as production-ready ('状态:Ready for Use'), but the roadmap still lists '接入真实平台API' as a future item. That creates an internal documentation contradiction about whether the described search capability is already implemented or still planned.

Content

No source excerpt is available for this finding.