Weibo Hot Search

• Outcome: Review
• Latest audit: Sep 11, 2026 · 9:28 PM UTC
• Version: 1.0.0

Overview

The skill’s goal is understandable, but it points to a missing script and includes unsafe runtime and process-killing instructions.

Review this skill before installing. It should include the referenced script in the package, require or verify a trusted Bun runtime instead of using an unpinned npx fallback, and avoid killing existing browser processes unless the user approves or the process is proven to belong to the skill.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:26
• Finding: Unpinned Remote Package Retrieval and Execution Through npx## Vulnerability Details **File Location**: `SKILL.md`, line 26 **Vulnerability Type**: Unsafe execution of an unpinned third-party dependency **Risk Level**: Medium ### Vulnerable Code ```text 4. Determine the `${BUN_X}` runtime: if `bun` is installed, use `bun`; if `npx` is available, use `npx -y bun`; otherwise, prompt the user to install bun ``` The fallback command is subsequently used to execute the Skill script: ```bash ${BUN_X} {baseDir}/scripts/weibo-hot-search.ts ``` ### Technical Analysis The instruction `npx -y bun` permits npm to resolve, download, and execute the package identified by the mutable name `bun`. No package version, integrity hash, lockfile, trusted registry configuration, or prior review is required. The `-y` option suppresses the normal confirmation prompt, so package retrieval and execution occur automatically. Consequently, the effective code executed by the Agent can differ from the code that existed when the Skill was reviewed. A compromised upstream release, registry account, package-resolution configuration, or package dependency could introduce arbitrary code. The repository itself contains no `scripts/` directory or dependency lockfile, so the expected runtime and script execution chain cannot be independently verified from the audited artifact. ### Attack Path 1. The target environment does not have a trusted `bun` executable installed. 2. The Agent detects that `npx` is available and follows the documented fallback. 3. The Agent invokes `npx -y bun` without a version or integrity constraint. 4. npm resolves and downloads the package and its dependency graph from the configured registry. 5. Package-controlled code executes with the same operating-system identity and environment as the Agent. 6. If the resolved package or one of its dependencies is compromised, it can read or modify files accessible to the Agent, access inherited environment variables, initiate network conn ...[truncated 509 chars]
• Remediation: ## Remediation Suggestions - Remove the automatic `npx -y bun` fallback and require a separately installed, trusted Bun executable. - If package-based installation is necessary, pin an explicitly reviewed version rather than resolving the latest release. - Verify downloaded artifacts using a trusted cryptographic checksum or signature. - Use a controlled package registry and a committed lockfile where applicable. - Do not suppress installation confirmation for code that will execute locally. - Validate the resolved executable path and version before invocation. - Run the Skill under a minimally privileged account with restricted filesystem, environment-variable, and network access. - Include the referenced script and dependency metadata in the distributed artifact so the full execution chain can be audited.

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: SKILL.md:77
• Finding: Unscoped Termination of Existing Browser Processes Without User Consent## Vulnerability Details **File Location**: `SKILL.md`, lines 77-82 **Vulnerability Type**: Unauthorised process control and violation of least privilege **Risk Level**: Medium ### Vulnerable Code ```bash pkill -f "Chrome.*remote-debugging-port" 2>/dev/null pkill -f "Edge.*remote-debugging-port" 2>/dev/null sleep 2 ``` The accompanying instruction states: ```text Important: When this error occurs, automatically terminate Chrome/Edge CDP processes and retry without asking the user. ``` ### Technical Analysis The commands use `pkill -f`, which matches regular expressions against complete process command lines. They do not verify that a matching Chrome or Edge process was started by this Skill, belongs to the current scraping operation, uses the same profile or debugging port, or is safe to terminate. The instruction explicitly removes user confirmation. Process termination is not required for the core read-only task of obtaining public trend data and therefore exceeds the operation's least-privilege requirements. Broad command-line matching may terminate unrelated browser automation, development, testing, or debugging sessions owned by the same operating-system user. Although normal `pkill` permissions generally limit termination to processes the caller is authorised to signal, all matching processes within that permission boundary are exposed. If the Agent runs under a shared or privileged identity, the affected scope can be wider. ### Attack Path 1. A user or another automation system starts Chrome or Edge with a `remote-debugging-port` argument. 2. The Skill encounters or reports a CDP readiness failure. 3. Following `SKILL.md`, the Agent runs both broad `pkill -f` commands without requesting approval. 4. The regular expressions match unrelated Chrome or Edge command lines containing the debugging-port option. 5. The operating system terminates every matching process the Agent is permitted to signal. 6. ...[truncated 657 chars]
• Remediation: ## Remediation Suggestions - Record the exact PID of every browser process launched by the Skill. - Terminate only a process whose PID, ownership, executable path, debugging port, and profile directory match the Skill-created instance. - Use graceful CDP shutdown or a normal termination signal before considering forced termination. - Never use broad `pkill -f` patterns as an automated recovery mechanism. - Request explicit user approval before terminating any pre-existing process. - If the selected port is occupied, allocate a new ephemeral port instead of killing the current listener. - Keep the browser process in a dedicated process group or container so cleanup cannot affect unrelated workloads. - Report conflicting process details to the user and stop safely when ownership cannot be established.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 84% confidence
• Finding: Using `npx -y bun` without pinning an exact version introduces supply-chain risk because execution depends on whatever package version is current at runtime. In a skill that instructs an agent to download and execute tooling automatically, this makes behavior non-reproducible and creates an opportunity for a compromised or malicious upstream release to run code on the host.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill explicitly authorizes automatically killing Chrome/Edge debugging processes without user confirmation, which can disrupt unrelated browser sessions, automation tasks, or developer workflows. In an agent context, broad process termination based on name matching can cause unintended denial of service on the local machine and affects resources beyond the skill's own scope.

Scope Creep

Low

• Category: Excessive Agency

Content

Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so.

THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

• Confidence: 70% confidence
• Finding: Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.

Static analysis

No suspicious patterns detected.