Security audit

Moss Skill-9

Security checks for vulnerabilities and agentic risk

Overview

This skill is not proven malicious, but it asks users to install unverified remote tooling and handle live account cookies in ways that could expose accounts.

Install only if you trust the upstream repository and are comfortable granting broad local tooling access. Do not paste personal account cookies or proxy passwords into an agent chat; use a dedicated low-privilege account if unavoidable, verify exactly what cookies will be stored, and prefer pinned releases or audited source before running the installer.

A.I.G

Vulnerability Patterns

Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T03 · Remote Payload Retrieval and Execution

Error

Location: SKILL.md:31
Finding: Execution of Mutable, Unverified Code from a Remote Repository
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: SKILL.md:48
Finding: Unsafe Handling and Broad Extraction of Browser Session Cookies
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Rogue AgentSelf-Modification, Session Persistence
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (10)

YARA rule 'agent_skill_remote_bootstrap_execution': Remote script or code download followed by execution/bootstrap installation [agent_skills]

High

Category: YARA Match
Confidence: 97% confidence
Finding: pip install directly from a GitHub archive on the main branch performs remote code retrieval from an unpinned moving target, creating a strong supply-chain and arbitrary-code-execution risk. In an agent skill, this is more dangerous because the install step is presented as the default bootstrap path and may be executed automatically by users or agents.
Content: Scanner excerpt · SKILL.md (reported line 33)May include surrounding context.
iles, clone repos, or write output in the agent workspace.** Use these directories instead:

Purpose Directory
Temporary output (subtitles, downloads) /tmp/
Upstream tool repos ~/.agent-reach/tools/
Config & tokens ~/.agent-reach/

Violating this will pollute the user's workspace and degrade their agent experience over time.

Setup

bash
pip install https://github.com/Panniantong/agent-reach/archive/main.zip agent-reach install --env=auto agent-reach doctor

install auto-detects your environment and installs core dependencies (Node.js, mcporter, xreach CLI, gh CLI, yt-dlp, feedparser). Run doctor to see what's active.

Management

bash
agent-reach doctor # channel status overview agent-reach watch # quick health + update check agent-reach check-update # check for new versions

Configure channels

bash
agent-reach configure twitter-cookies "auth_token=xxx; ct0=yyy" agent-reach configure p

Purpose	Directory
Temporary output (subtitles, downloads)	`/tmp/`
Upstream tool repos	`~/.agent-reach/tools/`
Config & tokens	`~/.agent-reach/`

Ssd 3

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The channel-configuration workflow explicitly tells the agent to ask users for cookies as part of setup, making credential collection a first-class behavior. That increases the likelihood of routine secret exfiltration and unsafe storage, especially when users may not understand that cookies are reusable authenticated sessions.
Content: No source excerpt is available for this finding.

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The workflow tells users to export a cookie header string and send it to the agent, but does not clearly warn that these are live session credentials that can grant account access. This can directly enable account takeover, impersonation, or long-lived session abuse if the credentials are logged, retained, or mishandled.
Content: No source excerpt is available for this finding.

Ssd 3

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: Instructing users to hand cookies to the agent and promoting browser cookie extraction creates a direct credential-harvesting pattern. This is especially dangerous in an agent skill because session tokens may be exposed in prompts, logs, telemetry, or downstream tools, enabling unauthorized access to platform accounts.
Content: No source excerpt is available for this finding.

YARA rule 'info_stealer': Information stealer patterns (credential harvesting, browser data theft) [malware]

High

Category: YARA Match
Confidence: 91% confidence
Finding: The --cookies-from-browser chrome pattern accesses browser-stored session data and can expose authenticated cookies for reuse by tooling. While there can be legitimate scraping use cases, this is credential extraction behavior and is dangerous because it enables silent reuse of web sessions outside the browser's normal security boundaries.
Content: Scanner excerpt · SKILL.md (reported line 130)May include surrounding context.
o "/tmp/%(id)s" "URL"

Then read the .vtt file

Search (yt-dlp ytsearch)

yt-dlp --dump-json "ytsearch5:query"

If "no JS runtime" warning: ensure Node.js is installed, then run:

mkdir -p ~/.config/yt-dlp && echo "--js-runtimes node" >> ~/.config/yt-dlp/config

text
### Bilibili (yt-dlp) > ⚠️ 服务器 IP 可能被 Bilibili 拦截（412 错误）。建议通过代理访问，或加 `--cookies-from-browser chrome`。 ```bash # Get video metadata yt-dlp --dump-json "https://www.bilibili.com/video/BVxxx" # Download subtitles yt-dlp --write-sub --write-auto-sub --sub-lang "zh-Hans,zh,en" --convert-subs vtt --skip-download -o "/tmp/%(id)s" "URL" # If blocked (412 / login required): yt-dlp --cookies-from-browser chrome --dump-json "URL"

Reddit (JSON API)

bash
# Read a subreddit curl -s "https://www.reddit.com/r/python/hot.json?limit=10" -H "User-Agent: agent-reach/1.0" # Read a post with comments curl -s "https://www.reddit.com/r/python/comments/POST_ID.json" -H

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 85% confidence
Finding: The skill defines activation triggers in Chinese and later includes section headers and operational guidance in Chinese, but does not state that language choice is optional or user-selected. This can violate language/locale policy expectations when a skill implicitly assumes a specific language without opt-in.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill includes collection and reuse of login cookies, including auto-extraction from a local browser, which is a highly sensitive credential-access capability. In the context of a channel installer, this is more dangerous because it normalizes obtaining session credentials as part of routine setup rather than treating them as exceptional secrets.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill is presented as an installer/configuration helper, but it also includes direct content publishing commands for XiaoHongShu. That capability expansion is security-relevant because it turns a setup skill into one that can perform outward actions on third-party accounts, increasing the chance of unintended posting or abuse.
Content: No source excerpt is available for this finding.

Session Persistence

Medium

Category: Rogue Agent
Confidence: 60% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · SKILL.md (reported line 125)May include surrounding context.
yt-dlp --dump-json "ytsearch5:query"

If "no JS runtime" warning: ensure Node.js is installed, then run:

mkdir -p ~/.config/yt-dlp && echo "--js-runtimes node" >> ~/.config/yt-dlp/config

text
### Bilibili (yt-dlp)

Rp1

Medium

Category: MCP Rug Pull
Confidence: 82% confidence
Finding: Using npx mcporter without a pinned version allows execution of whatever package version is currently resolved from the registry at runtime. That creates a supply-chain risk: a compromised or maliciously updated package could execute arbitrary code during use of the skill.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.

Overview

A.I.G

T03 · Remote Payload Retrieval and Execution

T09 · Insecure Skill Coding Practices

SkillSpector

YARA rule 'agent_skill_remote_bootstrap_execution': Remote script or code download followed by execution/bootstrap installation [agent_skills]

Setup

Management

Configure channels

Ssd 3

Missing User Warnings

Ssd 3

YARA rule 'info_stealer': Information stealer patterns (credential harvesting, browser data theft) [malware]

Then read the .vtt file

Search (yt-dlp ytsearch)

If "no JS runtime" warning: ensure Node.js is installed, then run:

mkdir -p ~/.config/yt-dlp && echo "--js-runtimes node" >> ~/.config/yt-dlp/config

Reddit (JSON API)

Natural-Language Policy Violations

Context-Inappropriate Capability

Description-Behavior Mismatch

Session Persistence

If "no JS runtime" warning: ensure Node.js is installed, then run:

mkdir -p ~/.config/yt-dlp && echo "--js-runtimes node" >> ~/.config/yt-dlp/config

Rp1

Static analysis