T09 · Insecure Skill Coding Practices
Error
- Location
references/xiaohongshu-cdp.md:34- Finding
Shell Command Injection Through Unencoded Search Parameters
- Content
View full analysis
- Remediation
View remediation
Security audit
bleisure-micro-vacation
Security checks for vulnerabilities and agentic risk
Overview
This travel-planning skill is coherent, but it asks agents to control a logged-in local Chrome session and save travel history by default, so it needs review before installation.
Review this skill before installing. It is not clearly malicious, but only use it if you are comfortable with local browser automation, Xiaohongshu account/session use, third-party map lookups for your locations, and persistent local logging of travel preferences and history. Prefer a separate browser profile and opt out of memory logging if supported.
Vulnerability Patterns
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Findings (5)
T02 · Agent Memory Poisoning
Warning
- Location
SKILL.md:127- Finding
Automatic Shared Persistence of User Travel History
- Content
View full analysis
- Remediation
View remediation
T08 · Insecure Dependencies
Warning
- Location
SKILL.md:147- Finding
Execution of an Unbundled External Skill Dependency
- Content
View full analysis
- Remediation
View remediation
T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
references/xiaohongshu-cdp.md:32- Finding
Excessive Access to an Authenticated Browser Through Remote Debugging
- Content
View full analysis
({title: item.querySelector(".title span")?.textContent?.trim() || item.querySelector(".title")?.textContent?.trim() || "", url: item.querySelector("a")?.href || "", likes: item.querySelector(".like-wrapper .count")?.textContent?.trim() || item.querySelector("[class*=\"like\"] span")?.textContent?.trim() || "0"})))' ``` ```bash curl -s "http://localhost:3456/close?target=TARGET_ID" ``` The same document states that Chrome remote debugging must be enabled and that the user's Chrome session should already be authenticated to Xiaohongshu. ### Technical Analysis Chrome DevTools Protocol access is a powerful browser-control capability. It can navigate pages and evaluate arbitrary JavaScript in browser targets. The documented workflow only needs public travel-search results, yet it requests access to a locally authenticated browser and relies on a general-purpose JavaScript evaluation endpoint. The local proxy is outside the audited package, and the instructions do not establish origin restrictions, target isolation, caller authentication, fixed read-only operations, or a dedicated browser profile. A compromised proxy or unsafe use of its evaluation interface could access substantially more browser data than the travel task requires. ### Attack Path 1. The user enables remote debugging on a normal Chrome profile containing authenticated sessions. 2. The Skill connects to the localhost CDP proxy. 3. The proxy creates or selects a browser target and ...[truncated 829 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Note
- Location
references/amap-poi-search.md:5- Finding
Plaintext API Key Storage and Exposure in Process Command Lines
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (23)
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md 与本 `SKILL.md` **同目录** 的 `standups.md` 为追加式记忆，用于越用越贴用户/团队习惯。
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The skill instructs reuse of a local CDP proxy on localhost:3456 to control the user's Chrome, which grants broad automation capability over a real browser session unrelated to the narrow travel-planning task. Even if only intended for search, this capability can expose cookies, authenticated pages, browsing contents, and other session data if misused or if selectors are changed.
- Content
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
Requiring the user's logged-in Xiaohongshu session introduces unjustified dependence on personal account context for a recommendation skill. This encourages the agent to operate inside an authenticated browser profile, increasing risk of accessing account-linked data and normalizing automation over private sessions without a strong need.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The description says to use the skill when the user '只报位置、想玩一下、出差间隙、会后放空、赶交通、酒店周边或要导航链接'. Several of these phrases are very general conversational intents, such as '想玩一下' or '要导航链接', and the file does not provide exclusion conditions to prevent accidental invocation in unrelated contexts.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The skill explicitly promotes cross-session memory of user preferences and travel history. Persistent retention and reuse of conversation-derived data can create privacy and profiling risks, especially when users may not expect long-term storage or reuse across sessions.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The style constraint explicitly requires using '你' and forbids using '您'. This is a natural-language policy issue because it forces a specific language/register choice without offering user opt-in or accommodation for user preference.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The instructions require appending conversation-derived preferences after most completed interactions, making persistence the default rather than an exception. This increases the likelihood of collecting more personal behavioral data than necessary and normalizes retention without strong consent gating.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The skill instructs the agent to execute a local Node.js script to check dependencies and conditionally enable CDP automation. Even though framed as a feature check, it expands the skill from travel advice into local tool execution, which increases attack surface and can be abused if the referenced script or environment is compromised.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The skill mandates CDP-based scraping of Xiaohongshu content and treats it as required output. This introduces browser automation and data extraction behavior beyond core trip-planning, creating unnecessary exposure to automation misuse, fragile scraping flows, and potential policy or data-handling issues.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
The trigger section states that phrases like '会后放空' and '差旅途中微度假' are applicable, and the preceding section labels itself as '触发与风格'. These are natural, high-level expressions that do not clearly distinguish this skill from ordinary conversation or other local-recommendation skills.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The entire skill guidance is written as mandatory Chinese-facing instructions, including required output phrases such as '输出中必须包含「坐标来源」' and user-facing text to present in Chinese. There is no indication that the skill is region-specific for policy reasons or that users may opt into another language, which creates a locale policy issue under the natural-language policy rule.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill instructs sending user-provided hotel, neighborhood, or landmark names directly to AMap's POI API without disclosing that this reveals the user's approximate location or itinerary context to a third party. In this skill's travel/nearby-recommendation context, location is central and often sensitive, so silent transmission creates a real privacy risk even if the API use is functionally appropriate.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The trigger section lists generic terms like '飞机', '航班', '高铁', and '火车', which commonly appear in everyday travel discussions and are not specific enough to distinguish when this skill should activate. The file also does not provide exclusion conditions or negative examples to clarify when the skill should not be invoked.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The file presents all operational instructions and user-facing phrasing exclusively in Chinese, with no indication that the user can choose another language or locale. Under SQP-3, forcing a specific language without user opt-in is a natural-language policy concern.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
The skill explicitly encourages alcohol- and massage-related recommendations as normal option categories, including late-night contexts, without requiring an upfront suitability, safety, age, or consent check. In a travel-assistant context this can steer vulnerable, tired, or intoxicated users toward risky activities, especially at night or in unfamiliar areas, and may surface adult services ambiguously under '按摩/足疗'.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The file title and instructions require the output to follow this Chinese-language template and to strictly preserve its structure, with no indication that users may choose another language or locale. This is a natural-language policy concern because it forces a specific language without opt-in or a documented region-specific justification.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The template explicitly instructs the system to append a standup entry for each interaction, which can cause persistence of user-related travel context, locations, preferences, and itinerary details beyond what is necessary for the immediate response. In a travel skill, those details may reveal sensitive behavioral patterns or whereabouts, increasing privacy risk if logged without minimization, consent, retention limits, and access controls.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The file is entirely written as mandatory Chinese instructions and examples, with no indication that the user may choose another language or that the skill is restricted to a Chinese-speaking context. This creates a natural-language locale policy issue because it implicitly enforces one language without opt-in.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The document makes CDP-based Xiaohongshu scraping a mandatory step before output, expanding the skill from generating recommendations and search keywords into browser automation against the user's local environment. That changes the trust boundary and can cause the agent to access browser state and third-party content in ways the skill description does not clearly disclose or justify.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill says CDP browsing and extraction should run automatically once a place is chosen, but it does not require a clear user-facing warning that the agent will access and manipulate the user's local Chrome session. Automatic execution against a logged-in browser materially increases privacy risk because the user may not realize their session context is being used.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 89% confidence
- Finding
This request opens a Xiaohongshu search URL through a local automation proxy, causing externally sourced content to be loaded into the user's browser session under agent control. In context, the danger is less about ordinary web access and more about the combination of third-party navigation, local browser automation, and potential authenticated state leakage.
- Content
"{地点名} {城市}"—— 补城市限定（如"大兜路 杭州 夜晚"）
bash curl -s "http://localhost:3456/new?url=https://www.xiaohongshu.com/search_result?keyword=KEYWORD&source=web_search_result_note"记录返回的
targetId。
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 96% confidence
- Finding
The /eval step extracts DOM content from the automated browser session and even suggests dumping chunks of innerHTML when selectors fail. That materially increases the risk of collecting unintended page data, including authenticated content, account-specific information, or embedded tokens, far beyond the minimum needed for travel recommendations.
- Content
- 先用
/eval查看实际 DOM 结构：bash curl -s -X POST "http://localhost:3456/eval?target=TARGET_ID" \ -d 'document.querySelector(".feeds-container")?.innerHTML?.substring(0, 2000) || document.body.innerHTML.substring(0, 2000)' - 根据实际结构调整选择器，重新提取。
- 先用
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The file’s natural-language instructions and template are written entirely in Chinese, including the required field labels, with no indication that other languages are allowed. Under the policy, forcing a specific language without user opt-in is a natural-language policy concern unless the locale restriction is explicitly justified.
- Content
Static analysis
No suspicious patterns detected.