Real Browser Qa Ceki Main

• Outcome: Review
• Latest audit: Jul 30, 2026 · 8:06 PM UTC
• Version: 1.0.0

Overview

This real-browser QA skill is mostly disclosed, but it needs Review because bundled profiles include third-party signup, CAPTCHA delegation, mailbox verification, and social engagement automation beyond owned-site testing.

Install only for clearly authorized QA/security testing. Prefer Self mode or a dedicated test browser profile, avoid Marketplace mode for production credentials or private content, remove or ignore the consumer-platform domain profiles, and do not use the skill for account creation, CAPTCHA solving, mailbox verification, social posting, liking, following, or payment-adjacent actions unless you have explicit authorization and human approval for each action.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (38)

Intent-Code Divergence

Medium

• Confidence: 87% confidence
• Finding: Although framed as QA/security testing, the skill advertises realistic user simulation, vulnerability discovery, and later includes profiles and interaction patterns that can be repurposed for third-party consumer platforms. That mismatch broadens the operational scope from owned-system testing into behavior-mimicking automation that may facilitate unauthorized activity or evasive abuse.

Context-Inappropriate Capability

High

• Confidence: 96% confidence
• Finding: Platform-specific social/media interaction profiles and selectors provide operational recipes for automating behavior on named third-party platforms, which exceeds the stated QA purpose. In a real-browser skill, these recipes materially lower the barrier to deceptive engagement, scraping, or policy-violating automation on external services.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: The documented CAPTCHA-testing sequence instructs building Google cookie history to influence challenge behavior, which is effectively guidance for manipulating trust signals. Even if framed as testing, this is a dual-use evasion tactic that can help bypass anti-abuse controls on sites beyond the owner's systems.

Context-Inappropriate Capability

Medium

• Confidence: 94% confidence
• Finding: The profile explicitly models automated login, 2FA handling, channel navigation, history reading, and message/reaction/voice interactions for Discord without any stated business purpose, authorization boundary, or user-consent guardrails. In a community chat platform context, this materially enables account-driven automation that could be used for spam, impersonation, scraping private server content, or unauthorized actions from a logged-in session.

Context-Inappropriate Capability

Low

• Confidence: 88% confidence
• Finding: The text fallback strategy contains imperative DOM automation logic that searches for UI elements by text and clicks them directly, making the profile more executable and action-oriented than a passive description. In an unknown-purpose skill, this increases the likelihood of brittle but effective automation against login flows or sensitive UI actions, especially when CSS selectors are intentionally bypassed.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: The profile is presented as a Reddit thread/comment browser, but it embeds a full account-registration workflow, IMAP mailbox polling for verification emails, captcha-solving delegation, and persistence/export steps. These capabilities materially expand the skill from passive browsing into account creation and anti-abuse bypass, which can enable large-scale automated account provisioning and platform abuse.

Description-Behavior Mismatch

High

• Confidence: 95% confidence
• Finding: The declared purpose is limited to browsing Reddit threads and comments, but the description explicitly includes signup automation, email verification, and captcha delegation. This mismatch is dangerous because it conceals higher-risk automation capabilities inside a seemingly benign profile, reducing operator scrutiny and making misuse easier.

Intent-Code Divergence

Medium

• Confidence: 83% confidence
• Finding: The profile gives contradictory guidance: it says login is likely required for full comment rendering, yet the sequence hint emphasizes reliable automation without login while also including a registration path. This inconsistency can mislead downstream agents into opportunistically switching between anonymous scraping and account creation to maintain automation, increasing abuse risk.

Context-Inappropriate Capability

Medium

• Confidence: 94% confidence
• Finding: This profile is presented as a feed browser, but it embeds instructions for authenticated engagement actions such as liking and commenting. That expands the skill from passive browsing into account-modifying behavior, creating risk of unauthorized engagement, spam, or abuse if an agent executes these actions automatically under a logged-in user session.

Context-Inappropriate Capability

Medium

• Confidence: 96% confidence
• Finding: The sequence hint explicitly automates authenticated engagement flow: navigating the For You Page, liking content, visiting profiles, and repeating the cycle. In context, this is more dangerous because the file is a platform-specific automation profile for TikTok, so these instructions operationalize repetitive user-account actions that can be used for engagement manipulation or policy-violating bot behavior.

Context-Inappropriate Capability

Medium

• Confidence: 92% confidence
• Finding: The profile explicitly encodes behavior for posting chat messages, following/unfollowing, clipping, subscribing, and payment-adjacent account actions without any declared business purpose or policy guardrails. In an agent skill, these interaction recipes can be repurposed for spam, unauthorized social engagement, or deceptive account activity, and the lack of justification makes the capability set materially more suspicious.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: The file contains detailed login flow support, including password entry timing, post-login waits, and 2FA methods, despite the profile stating requires_login=false and offering no justified authenticated use case. This lowers the barrier for automating access to user accounts and increases the risk of credential misuse, account takeover assistance, or scripted actions performed under a victim's identity.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The README states that in Marketplace mode 'The host can see your session,' but it does not prominently warn users about the privacy and data exposure consequences of using a third party's browser. Users may unknowingly enter credentials, view sensitive dashboards, or expose internal application data during testing, creating avoidable confidentiality risks.

Natural-Language Policy Violations

Medium

• Confidence: 84% confidence
• Finding: Demographic and gender-specific behavior profiles are not necessary for generic QA and introduce profiling functionality with weak policy justification. In this context, they increase the realism of impersonation and can enable unfair or deceptive simulation of specific user groups without consent or a clear legitimate need.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The listing explicitly offers third-party browser rental and opt-in hosting, but it does not clearly disclose the privacy, credential, session, and local-environment risks that can arise when an agent drives a browser that belongs to another user or exposes your own browser to marketplace use. In a security-testing skill, users may handle sensitive targets, cookies, screenshots, or authenticated sessions, so incomplete warnings can lead to unintended data exposure or host compromise assumptions.

Missing User Warnings

High

• Confidence: 97% confidence
• Finding: The example injects a hardcoded secret directly into a login form without any user confirmation or warning, which normalizes unsafe secret handling and could lead developers to embed real credentials in code, logs, or repositories. In the context of an account-login skill, this is especially dangerous because it automates authentication to a real service and combines credential use with a subsequent human 2FA step, making unauthorized account access more plausible if reused with live secrets.

Vague Triggers

Medium

• Confidence: 96% confidence
• Finding: The manifest grants a broad set of browser-control tools under alwaysAllow, including navigation, clicking, typing, scrolling, and a domain-specific action, without any visible trigger conditions, scoping, or user confirmation boundaries. If the connected server or downstream prompts are influenced by untrusted input, these permissions could enable unintended web actions, data entry, or interaction with sensitive pages without adequate user review.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The manifest references an API key through an environment variable, which indicates the skill depends on sensitive credentials, but it provides no user-facing guidance on secure provisioning, storage, rotation, or exposure risks. While the example uses a placeholder value rather than a real secret, normalizing credential use without warnings can lead to accidental secret leakage or unsafe deployment practices.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The manifest explicitly states that marketplace sessions are visible to the host, yet it does not clearly warn that browsing content, session interactions, and potentially sensitive data may be exposed to third-party hosts and backend services. In a skill designed for browser-based QA and security testing, this omission is dangerous because users or agents may use the marketplace mode on sensitive sites, credentials, or internal applications without understanding the privacy and data-exposure risk.

Vague Triggers

Medium

• Confidence: 90% confidence
• Finding: The profile applies broadly to the domains without explicit trigger constraints, path scoping, or exclusions, so an agent could activate on unintended pages such as account, auth, settings, or admin-like flows. In a browser automation context, this increases the chance of performing actions like login, commenting, bookmarking, or publishing outside the user’s intended scope.

Natural-Language Policy Violations

High

• Confidence: 98% confidence
• Finding: This profile encodes detailed behavioral timing, scrolling, clicking, and login interaction patterns specifically designed to imitate human Facebook usage while acknowledging strong anti-bot protections and session requirements. In this context, the natural-language guidance is not neutral documentation; it operationalizes stealthy automation intended to evade platform detection, which materially increases the risk of account abuse, unauthorized scraping, and policy circumvention.

Vague Triggers

Medium

• Confidence: 92% confidence
• Finding: The profile description is not merely broad; it explicitly bundles Google Search, Gmail, Google Ads, Business Profile, login flows, and account creation into one automation profile while referencing scraping, anti-bot behavior, and workaround research. That scope expansion increases the chance the skill is applied to sensitive authenticated surfaces and anti-abuse-protected workflows without clear authorization boundaries, enabling misuse for scraping, account access, or evasion-oriented automation.

Natural-Language Policy Violations

Low

• Confidence: 97% confidence
• Finding: This section gives operational guidance for bypass-adjacent behavior around Google's phone-verification gate, including success conditions based on IP reputation and recommended use of clean residential IPs. In context, that is not a neutral regional note; it is actionable anti-abuse knowledge that can facilitate evasion of account creation safeguards and support fraudulent or policy-violating account generation.

Natural-Language Policy Violations

High

• Confidence: 99% confidence
• Finding: The skill explicitly instructs detecting captchas, taking screenshots, sending them to a provider chat, and waiting for a solution. This is a direct anti-abuse bypass pattern that undermines platform protections and facilitates automated signup or scraping at scale.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The profile includes IMAP host, port, search behavior, and email-verification polling logic without any safeguards for credential storage, consent, retention, or privacy. Even if intended for convenience, this normalizes automated access to a mailbox and creates risk of credential misuse, unauthorized inbox access, and leakage of sensitive email contents.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.