Security audit

X Manual Surf Notes (手动刷帖笔记)

Security checks for vulnerabilities and agentic risk

Overview

The skill does what it claims, but it uses an authenticated live Chrome session and appends collected X content to a hard-coded local file with limited user-facing guardrails.

Review this skill before installing. Use it only with a dedicated Chrome profile or isolated X tab, verify the relay is attached only where intended, and change or confirm the output file path before running so collected timeline content is not written to an unexpected local project file.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The trigger list is broad enough that the skill could activate on generic requests about browsing X or taking notes, causing browser-driven collection and file-writing behavior without sufficiently precise user intent. Because the skill performs external navigation and persistent note appending, ambiguous activation increases the chance of unintended data collection or actions on the user's environment.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The description explicitly instructs the agent to translate or restate tweet content into Chinese and the rest of the workflow reinforces Chinese-only output. This imposes a language preference without documenting user opt-in or offering an alternative locale/output language.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The skill directs the agent to append scraped content to a fixed local path under the user's workspace without an explicit user-facing confirmation at execution time. Any skill that writes persistent data to a predetermined file can unexpectedly alter local state, overwrite user expectations, leak collected content into sensitive project directories, or be abused through accidental invocation.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The listing says the skill controls the user's existing Chrome tab through a Chrome Extension Relay, but it does not disclose the privacy and session risks of acting inside an already-authenticated browser context. This is dangerous because the skill could access or manipulate content visible in the active session, including private timeline data, messages, account state, or unrelated tabs if the relay is overly permissive, and users are not clearly warned about that trust boundary.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The listing explicitly states that the skill will append structured notes to a markdown file, but it does not warn the user that local content will be modified. Even though this is expected workflow behavior rather than covert tampering, the omission can still lead to unintended file changes, confusion about where data is being written, or accidental overwrite/duplication in a local notes repository.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.