Security audit
Security checks for vulnerabilities and agentic risk
Review before installing: this skill requests unnecessary privileges for long-lived background tasks and can interrupt active browser work.
Ask for ordinary-user task privileges, automatic cleanup when importing finishes, and browser ownership checks before unattended use. Keep this browser profile separate from everyday browsing and start with two items. The profile retains your login, eval can act as your account, and changes require manual reversal. Remove the MyLikeFavChromeKeepalive, MyLikeFavChrome, and MyLikeFavFront tasks and any configured import schedule when finished. The external scheduling wrapper was not supplied for review.
Referenced artifact was not completely inspected
Tools\mylike-fav-import\keepalive_hidden.vbs"`；VBS 用 `Run(..., 0, False)` 隐藏启动 `keepalive.ps1`。不要把 `powershell.exe -WindowStyle Hidden` 直接写进任务动作——它仍会每轮闪一次控制台窗口
Referenced artifact was not completely inspected
- `keepalive.ps1` 已内联窗口隐藏（`Add-Type WinApiKH` + `EnumWindows`/`ShowWindow`），一轮只起一个进程；`hide_chrome_window.ps1` 仅留作手工单跑
Referenced artifact was not completely inspected
- `keepalive.ps1` 已内联窗口隐藏（`Add-Type WinApiKH` + `EnumWindows`/`ShowWindow`），一轮只起一个进程；`hide_chrome_window.ps1` 仅留作手工单跑
At L125–L128, the command passes caller-supplied --js directly to s.eval, which executes it through CDP Runtime.evaluate (L40–L43). Unlike the fixed favorite-management operations, this allows arbitrary page-context actions, including accessing page data and issuing authenticated requests unrelated to adding videos to a collection.
Periodic keepalive execution is documented, but running its PowerShell script with the highest available privileges is unnecessary. If an administrative user registers this task and a lower-privilege actor can modify its script or dependencies, subsequent scheduled runs could execute attacker-controlled code with elevated privileges; the supplied source does not establish protective filesystem ACLs.
The command passes caller-provided --js directly to s.eval, which executes it through CDP Runtime.evaluate (L048–L051). Unlike the fixed favorite-management operations, this permits arbitrary page-context actions and access to page-accessible account data, with results returned to the caller. General-purpose browser scripting is not justified by the manifest's batch collection, folder management, verification, and resume functionality.
Without declared permissions the skill's intent is opaque and cannot be validated.
The script connects to an existing browser debugger on port 9333 and issues Browser.close, shutting down that browser and all its tabs. Browser-wide shutdown exceeds the stated favorites-management purpose, and this script does not establish that the browser is a disposable instance owned by the skill.
The script sends a Browser.close command, which closes the entire connected browser rather than just its debugging connection. There is no confirmation, user-facing log, or explanatory comment disclosing this action, which can interrupt active browsing and unsaved work.
The script identifies visible windows belonging to the dedicated Chrome profile and calls ShowWindow(h, 0) at L46 to hide them. Browser interaction is expected for managing Douyin favorites, but suppressing browser-window visibility is neither declared nor necessary for that purpose and reduces the user's ability to observe the automation.
The task unnecessarily requests the user's highest available token to launch a web-facing browser with remote debugging enabled. For an administrative account, this increases the consequences of browser or debugging-interface compromise; it does not independently grant administrator rights to a standard user.
The cleanup comment promises session-0 targeting, but the code forcibly kills every Chrome process whose command line contains the workspace substring, without checking its session. Running this documented launcher can therefore terminate an active interactive automation browser, interrupt work, and lose unsaved state.
Interactive desktop placement does not require launching Chrome with the highest available privileges. When the account can elevate, the task unnecessarily exposes a higher-privilege browser and debugging endpoint, increasing the impact of compromise.
The loop sends every payload variant to the collection-move endpoint using the user's authenticated session, rather than performing a read-only probe. The usage comments explain how to run the script but do not disclose the repeated account mutations, and there is no confirmation prompt or user-facing warning before execution.
Bringing an automation window to the foreground does not justify running a PowerShell script with the highest available token. For an administrative account, modification of front.ps1 by a less-privileged actor could turn later task invocations into elevated code execution if the workspace is writable.
The script scans all visible desktop windows and retains process IDs, window classes, and titles for console windows or titles matching keepalive, powershell, or wscript, without restricting them to the skill's processes. It prints those records at L59–L61 and additionally lists system-wide scripting-process metadata at L66–L68. Collecting and reporting unrelated application metadata is not justified by batch favoriting, folder management, verification, or resumable execution.
Lines L02–L05 replace the action of the existing MyLikeFavChromeKeepalive scheduled task with wscript.exe running keepalive_hidden.vbs in batch mode. Batch favoriting, folder management, verification, and resumability do not directly justify changing an OS-level scheduled task; this change also remains in effect beyond the current skill invocation. The script's contents and the task's triggers are not shown, so no further payload behavior is inferred.
After the three-hour timeout, execution unconditionally proceeds to state reordering even if the batch process is still active. In a resumable batch workflow, concurrent state updates can cause lost progress, inconsistent ordering, or skipped or repeated actions, depending on how the companion script writes state. The additional 15-second delay provides no mutual-exclusion guarantee.
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
print("%s wait timeout, reorder anyway" % time.strftime("%H:%M:%S"))
time.sleep(15)
r = subprocess.run([sys.executable, os.path.join(BASE, "reorder_state.py"), xlsx],
capture_output=True, text=True)
print("%s reorder rc=%s %s %s" % (time.strftime("%H:%M:%S"), r.returncode,
r.stdout.strip(), r.stderr.strip()))
Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.
"license": "ISC",
"type": "commonjs",
"dependencies": {
"ws": "^8.22.1"
}
}