T08 · Insecure Dependencies
Warning
- Location
SKILL.md:53- Finding
Unpinned Third-Party Packages and Browser Artifact
- Content
View full analysis
- Remediation
View remediation
Security audit
Dcard
Security checks for vulnerabilities and agentic risk
Overview
This skill is not clearly malicious, but it needs review because it automates Dcard scraping through anti-bot bypass and installs/runs browser tooling with weak supply-chain and isolation controls.
Install only in an isolated, unprivileged environment after checking the dependency and Camoufox versions yourself. Be aware that the skill is designed to bypass Dcard's Cloudflare protection and can list forum content, so confirm that your use complies with Dcard's terms and avoid bulk or automated scraping.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/dcard_fetch.py:22- Finding
Execution of a Hard-Coded Cache Binary with Browser Sandboxing Disabled
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (10)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The skill is presented as a tool for fetching full content from a single Dcard post, but the documentation exposes additional collection features such as popular/latest listing and all-forum enumeration. This expands the operational scope from targeted retrieval to scalable discovery and scraping, increasing abuse potential and undermining informed approval decisions.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
The skill is presented as a tool for fetching full content from a single Dcard post, but the documentation exposes additional collection features such as popular/latest listing and all-forum enumeration. This expands the operational scope from targeted retrieval to scalable discovery and scraping, increasing abuse potential and undermining informed approval decisions.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 92% confidence
- Finding
The skill declares no explicit tool scope or permissions despite clearly requiring network access and browser automation. This is dangerous because it hides the effective capability boundary from users and the hosting agent, making it easier for the skill to access external sites without transparent consent or least-privilege enforcement.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The manifest frames the skill as single-post extraction, while the documentation exposes forum-wide listing capabilities. This inconsistency is dangerous because it conceals broader data-access functionality that could be used for bulk scraping or reconnaissance beyond the user's apparent intent.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The documentation openly states that stealth browser tooling is used to bypass Cloudflare, but it does not warn users about the legal, policy, and operational risks of evading third-party anti-bot protections. In context, anti-bot bypass materially raises the danger because the skill is designed to defeat access controls rather than simply consume a public API.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The manifest describes a skill for extracting the full content of a Dcard article, including title, body, and image links. However, the code and module usage documentation add broader browsing capabilities: listing posts in a forum and enumerating popular forums, which goes beyond single-article extraction.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The browser context is hard-coded to use locale "zh-TW" and timezone "Asia/Taipei". This is a natural-language policy concern because it imposes a specific regional setting on all runs without offering user opt-in or explaining that the tool is intended only for that locale.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The skill description is written entirely in Traditional Chinese and does not indicate that other languages are supported or that the language choice is intentional and region-specific. Under the stated policy, forcing a specific language without user opt-in is a natural-language policy concern.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
The code explicitly matches Chinese time words like '小時', '分鐘', '天', '週', and '月' when filtering title lines. This bakes in a language/locale assumption in natural-language handling without any visible opt-in or explanation that the skill is intentionally limited to that locale.
- Content
Description-Behavior Mismatch
Low
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
The stated purpose is article content extraction with title, full text, and image links. The implementation additionally injects URL and post_id fields into the returned data, which is broader than the declared output schema, though still related to the same object.
- Content