Security audit

HTML-to-Selenium 网页元素识别和selenium自动化

Security checks for vulnerabilities and agentic risk

Overview

The skill’s browser automation purpose is clear, but it can submit credentials and persist authenticated page contents with weak scoping and safeguards.

Review before installing. Use this only for domains you explicitly trust, avoid setting broad ROUTER_* credentials in the environment, do not pass real passwords on the command line, and treat generated screenshots and HTML as sensitive files that may contain private account or internal system data.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (6)

T09 · Insecure Skill Coding Practices

Error

Location: scripts/fetch_page.py:174
Finding: Credentials Are Automatically Submitted to an Unvalidated Destination
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/fetch_page.py:174
Finding: Arbitrary Browser Navigation Enables Server-Side Request Forgery and Internal Resource Capture
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/fetch_page.py:271
Finding: Plaintext Command-Line Credentials Can Leak Through Process and Shell Metadata
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/fetch_page.py:216
Finding: Authenticated Page Content Is Persisted Without Access-Control or Cleanup Protections
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: references/examples.md:21
Finding: Generated Selenium Templates Disable the Chromium Sandbox
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Note

Location: MANIFEST.md:15
Finding: Unpinned Dependencies and Browser Binaries Are Installed from Mutable Upstream Sources
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (26)

Vague Triggers

High

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The trigger conditions are very broad, including generic phrases like '帮我完成 xxx' and '帮我操作 xxx', which can cause the skill to activate for many unrelated requests. In this skill’s context, accidental activation is risky because it can lead to webpage fetching, DOM capture, and generation of automation for sensitive sites without sufficiently specific user intent.
Content: No source excerpt is available for this finding.

Vague Triggers

High

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The quick-reference trigger list repeats ambiguous activation rules and lacks constraints that the user must explicitly request webpage analysis or Selenium generation. Because this skill handles screenshots, rendered HTML, login flows, and automation guidance, imprecise triggering increases the chance of unintended collection or execution-oriented assistance on sensitive pages.
Content: No source excerpt is available for this finding.

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 227)May include surrounding context.
md
| `SKILL.md` | 主工作流说明 | 触发时 |

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 72% confidence
Finding: The primary skill description and usage instructions are presented in Chinese, including trigger wording, behavior notes, and safety guidance, with no statement that users may choose their preferred language. This can constitute a language-policy issue if the skill implicitly requires Chinese interaction rather than offering locale choice or documenting a justified region-specific constraint.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The manifest advertises broad trigger phrases such as '分析页面', '生成 selenium', and '帮我操作 xxx', which can match ordinary user requests and cause unintended activation of a highly autonomous browser-automation skill. Because the skill can use credentials and perform login flows, accidental invocation increases the chance of unauthorized actions, credential exposure in context, or automation against sensitive internal systems.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 69% confidence
Finding: The manifest and operational instructions are written entirely in Chinese, including trigger phrases and output requirements, with no indication that users may choose another language. This can conflict with language/locale policy if the skill implicitly requires Chinese rather than offering a user choice.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The skill describes capturing full-page screenshots, rendered HTML DOM, metadata, and potentially login-related state, but does not clearly warn users that page contents will be stored to disk. This is dangerous because users may invoke the skill on pages containing personal data, internal dashboards, or sensitive business information without understanding the retention and exposure implications.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 83% confidence
Finding: The primary skill description and trigger wording are presented in Chinese only, which implies a language-specific interaction model without stating that users may choose another language. While some environment variable descriptions and warnings are bilingual later in the file, the manifest does not clearly offer language choice for normal skill use.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The manifest advertises very broad trigger phrases such as '分析页面', '生成 selenium', '网页自动化', and '帮我操作 xxx', which can cause the skill to activate in response to generic user requests that are not clearly intended to invoke browser automation. In this skill's context, unintended invocation is more dangerous because the skill is autonomous and may perform page access, form interaction, and login attempts using supplied credentials.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The activation description includes broad phrases like helping operate pages or complete tasks, which can match ordinary user requests without clear security boundaries. This increases the chance the skill is invoked for sensitive browser automation, credential entry, or actions on third-party sites without sufficiently explicit user intent or narrowing constraints.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The manifest description and instructions are written to operate in Chinese and do not indicate that the skill can respond in another language or follow the user's preferred locale. This can violate language/locale policy when the user has not opted into Chinese or when the environment is multilingual.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The quick-reference trigger list repeats ambiguous phrases that can cause accidental invocation in normal conversation. In this skill's context, accidental activation is more dangerous because the workflow includes page fetching, possible login handling, DOM extraction, and generation of actionable automation steps for arbitrary websites.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The skill states that credentials must only be supplied in conversation, yet it also declares router credential environment variables at the top. That contradiction creates a real risk that the skill or its supporting scripts may implicitly consume ambient secrets, causing unintended credential use or disclosure during webpage automation against login-protected targets.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The documentation explicitly demonstrates automated login by locating username/password fields and entering hardcoded credentials, even though the file is presented as a general Selenium reference rather than a narrowly scoped authentication skill. This can normalize credential-handling behavior and lead downstream agents or users to embed secrets in automation flows without proper safeguards, increasing the risk of unauthorized access or secret leakage.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The login example shows direct handling of sensitive authentication data, including a plaintext password string, without any warning about secure credential management. This encourages insecure copying of patterns into real workflows, where secrets may be committed to repositories, exposed in logs, or reused in unauthorized automation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The file is entirely written as mandatory guidance in Chinese and states that all generated Selenium code must follow these rules, but it does not indicate that Chinese is optional or tied to a region-specific requirement. Under the stated policy, forcing a specific language without opt-in can be a natural-language policy violation.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The module documentation materially understates behavior by describing simple page capture while the script can also detect login pages, read credentials from arguments or environment variables, and perform automated authentication. This is dangerous because operators may run it against sensitive targets without realizing it will submit credentials and then collect authenticated content, expanding the security and privacy impact beyond what the documentation suggests.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The script implicitly pulls credentials from environment variables and uses them for automatic login, which can cause unintended credential use against an untrusted or mistyped URL. This is especially risky in automation/agent environments where secrets are broadly injected into the process environment and the operator may not realize this script will consume them.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: After login, the script automatically stores full-page screenshots and rendered HTML to disk, which can include account data, CSRF tokens, internal application state, or other sensitive information. In an agent skill context, this is more dangerous because the captured files may be persisted, shared with downstream tools, or exposed to users who did not intend to export authenticated content.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The example includes hardcoded login credentials and demonstrates automated authentication plus screenshot/file-writing behavior without any guidance on secret handling or output sanitization. In an agent skill, examples often get copied into production workflows, which can normalize insecure credential storage and create artifacts that may capture sensitive account data or authenticated application state.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The file title and normative guidance are entirely in Chinese, and line L003 states that all generated Selenium code must follow these rules, implicitly imposing a single language/locale. Under the policy, forcing a specific language without user opt-in or documented regional justification is a natural-language policy violation.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The module docstring and advertised usage describe a page-fetching and screenshot tool, but the implementation also detects login pages and can automatically submit credentials from CLI arguments or environment variables. This hidden capability increases the risk of credential misuse, unintended authenticated access, and accidental collection of sensitive post-login content because operators may not realize the script performs authentication.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: This Python file contains user-facing natural-language documentation and runtime messages exclusively in Chinese, including the module docstring and command-line help text. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale constraint is clearly documented and justified, which is not present here.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 82% confidence
Finding: The screenshot helper writes image files to a local screenshots directory without warning that artifacts will be created and may contain sensitive page contents. In automation contexts, screenshots can capture personal data, admin panels, or session-specific information and persist it on disk longer than intended.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 80% confidence
Finding: This markdown file includes a screenshot helper that writes image files to a local screenshots directory, which can capture page contents and user data. The surrounding documentation does not warn readers that running this pattern creates persistent files containing potentially sensitive visual information.
Content: No source excerpt is available for this finding.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: html-to-selenium/SKILL.md:123

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: SKILL.md:117