ClawHub
Back to skill

Security audit

Weibo Hot Search Anonymous

Security checks for vulnerabilities and agentic risk

Overview

The skill mostly does what it claims, but it asks for login despite advertising anonymous use and can automatically control or terminate local browser debugging processes.

Review before installing. Use only with a dedicated throwaway browser profile, avoid logging into a personal Weibo account through this skill, and do not let it kill browser processes automatically on a workstation with other Chrome/Edge automation. Prefer a trusted preinstalled Bun runtime instead of the unpinned npx fallback.

A.I.G

Vulnerability Patterns
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:25
Finding

Unpinned Package Download and Execution Through npx

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:25, SKILL.md:42-45, and scripts/weibo-hot-search.ts:330-340
Vulnerability Type: Unpinned third-party package execution
Risk Level: Medium

The Skill instructs the agent to use the following fallback when a locally installed Bun runtime is unavailable:

bash
npx -y bun

The same unpinned invocation is presented in the command-line usage text:

bash
npx -y bun weibo-hot-search.ts [options]

Technical Analysis

The npx -y bun command automatically resolves, downloads, and executes the npm package currently published under the name bun. No exact package version, lockfile, package integrity value, or trusted artifact source is specified.

The -y option suppresses the normal installation confirmation. Consequently, following the documented fallback can execute package lifecycle code and package entry points without additional user review. The effective code executed by the Skill can therefore change after the Skill itself has been audited.

This creates a supply-chain trust boundary outside the reviewed repository. If the resolved package, its dependencies, the registry account, or the registry response is compromised, malicious code can execute under the identity of the user or agent running the Skill.

Attack Path

  1. Bun is not installed as a trusted local executable.
  2. The agent follows the documented runtime-selection instructions.
  3. The agent invokes npx -y bun without an exact version.
  4. npm resolves and downloads the package and its dependency graph from the configured registry.
  5. A compromised or unexpectedly modified package executes with the permissions of the agent process.
  6. The package can access files, environment variables, network resources, and subprocess capabilities available to that process before running the intended script.

Impact Assessment

Successful exploitation provides arbitrary code exe ...[truncated 569 chars]

Remediation
View remediation

Remediation Suggestions

  1. Require a trusted, preinstalled Bun executable rather than downloading it during Skill execution.
  2. If npx support is necessary, pin an audited exact version, for example:
    bash
    npx --yes bun@EXACT_AUDITED_VERSION
  3. Commit and enforce dependency lock and integrity metadata where the runtime environment supports it.
  4. Verify downloaded artifacts against an independently maintained checksum or trusted signature.
  5. Avoid suppressing installation confirmation in agent-operated environments.
  6. Document the expected package publisher, version, checksum, and update-review process.
  7. Prefer a controlled installation step performed before Skill invocation, with runtime execution configured to prohibit network-based package resolution.

T05 · Unauthorized Access and Privilege Escalation

Warning
Location
SKILL.md:83
Finding

Overbroad Automatic Termination of Browser Debugging Processes

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:83-90
Vulnerability Type: Excessive process-control scope
Risk Level: Medium

The troubleshooting instructions direct the agent to run broad process-matching commands:

bash
pkill -f "Chrome.*remote-debugging-port" 2>/dev/null
pkill -f "Edge.*remote-debugging-port" 2>/dev/null
sleep 2

The surrounding instruction requires automatic termination and retry without requesting user confirmation.

Technical Analysis

The pkill -f command matches against complete process command lines. These patterns are not restricted to:

  • The browser process started by this Skill.
  • The configured browser profile directory.
  • A PID recorded at process creation.
  • The debugging port allocated for the current execution.
  • Processes owned by a specific logical browser session.

Any Chrome or Edge process whose command line contains a matching remote-debugging-port argument may be terminated. This can include unrelated browser automation, testing, development, or agent sessions belonging to the same operating-system user.

The implementation in scripts/weibo-utils.ts contains a narrower profile-based termination function, but the Skill documentation separately tells the agent to execute the broader pkill commands. An agent following the Skill instructions may therefore exceed the scope required to recover its own browser instance.

Attack Path

  1. One or more unrelated Chrome or Edge CDP sessions are running under the same operating-system account.
  2. The Skill encounters a browser debugging-port readiness failure.
  3. The agent follows the mandatory troubleshooting procedure without asking the user.
  4. pkill -f searches all visible process command lines for the broad patterns.
  5. Every matching Chrome or Edge debugging process is sent a termination signal.
  6. Unrelated automation sessions are interrupted, and unsaved browser state or active tasks may ...[truncated 713 chars]
Remediation
View remediation

Remediation Suggestions

  1. Remove the broad pkill -f troubleshooting commands.
  2. Record the PID returned when the Skill launches Chrome or Edge and terminate only that specific PID.
  3. Verify the PID still belongs to the expected executable, profile directory, and debugging port before signaling it.
  4. Use the profile-scoped process-identification logic already present in killChromeByProfile, while strengthening it with exact argument parsing rather than substring matching.
  5. Request explicit user confirmation before terminating any process not created during the current Skill run.
  6. Prefer closing the CDP target or browser gracefully through the established CDP connection.
  7. If cleanup cannot be safely attributed to the current execution, report the stale process and stop rather than terminating unrelated sessions.
  8. Avoid running the Skill with elevated operating-system privileges.

SkillSpector

Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (13)

Tp4

High
Category
MCP Tool Poisoning
Confidence
96% confidence
Finding

The declared purpose is simple hot-search collection, but the behavior described includes host inspection, environment-driven browser selection, process scanning, TCP port allocation, and WebSocket CDP control. Those are materially more powerful local capabilities than a user would expect from a content-fetching skill, and they increase the attack surface for privacy impact, host interference, and misuse of an existing browser instance.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
90% confidence
Finding

The declared purpose is simple hot-search collection, but the behavior described includes host inspection, environment-driven browser selection, process scanning, TCP port allocation, and WebSocket CDP control. Those are materially more powerful local capabilities than a user would expect from a content-fetching skill, and they increase the attack surface for privacy impact, host interference, and misuse of an existing browser instance.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

The skill advertises anonymous retrieval, but if the hot-search list is not accessible it waits for the operator to log into Weibo in a local browser profile and then continues scraping through that authenticated session. This is dangerous because it can induce users to expose personal account state and credentials to a skill whose stated purpose does not require authentication, increasing privacy and session-risk beyond user expectations.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
87% confidence
Finding

The skill clearly requires network access and reads environment-controlled configuration, yet it declares no explicit tool scope or permission boundaries. That makes the actual execution capabilities broader and less auditable than the manifest suggests, increasing the chance of unintended access or unsafe invocation by an agent runtime.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
92% confidence
Finding

Using npx -y bun without a pinned version allows retrieval of whatever package version is current at execution time, creating a supply-chain risk and making runs non-reproducible. If the upstream package is compromised or changes behavior, the skill could execute attacker-controlled code on the host.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The instructions authorize automatic termination of Chrome/Edge debugging processes without warning the user, which can disrupt active browsing sessions, terminate unrelated automation, or cause data loss. In a shared or developer workstation context, killing processes by pattern match is especially risky because it may affect software outside the intended task.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The code discovers and attaches to an existing Chrome debug port and reuses a persistent user-data directory, which grants the script access to the full browser context of that profile rather than the minimum needed to fetch public trending data. Through CDP, a script with this access can inspect pages, cookies, storage, and authenticated state, so reusing a personal session materially expands the blast radius if the skill is modified, compromised, or misused.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The function scans the full system process list to discover Chrome instances exposing remote debugging ports associated with a profile directory. This exceeds the minimum capability needed for scraping public hot-search data and exposes sensitive host execution metadata; it also creates a path to attach to an already-running browser debug session, which could grant access to browsing context beyond this skill's purpose.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The function enumerates host processes via ps aux and terminates matching Chrome instances based on a profile path and debug-port flag. For a skill whose stated purpose is anonymous retrieval of Weibo hot-search data, killing existing browser processes is unnecessary and creates an integrity/availability risk by interfering with unrelated user activity or other automations using Chrome.

Content

No source excerpt is available for this finding.

Scope Creep

Low
Category
Excessive Agency
Confidence
70% confidence
Finding

Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.

Content

Scanner excerpt · LICENSE.md (reported line 7)May include surrounding context.

md
Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so.

THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

Static analysis

Detected: suspicious.dangerous_exec, suspicious.env_credential_access

Shell command execution detected (child_process).

Critical
Code
suspicious.dangerous_exec
Location
scripts/weibo-hot-search.ts:119

Shell command execution detected (child_process).

Critical
Code
suspicious.dangerous_exec
Location
scripts/weibo-utils.ts:52

Environment variable access combined with network send.

Critical
Code
suspicious.env_credential_access
Location
scripts/weibo-utils.ts:35