Security audit

GPT Web Chat Skill

Security checks for vulnerabilities and agentic risk

Overview

This skill openly aims to automate ChatGPT in a browser, but it relies on missing runtime scripts and may reuse a logged-in browser session in the background.

Review before installing. Use this only when you intentionally want prompts sent to chatgpt.com through a browser session, and avoid sensitive content unless you are comfortable with that session reuse. The package should include or clearly pin the runtime scripts it tells the agent to execute, plus clear first-use confirmation and cleanup guidance for stored browser session data.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Credential Access

High

Category: Privilege Escalation
Content: chat.py │ ├── Stage 1: 环境 │ ├── .env 不存在 → ENV_NOT_FOUND │ ├── userdata/ 不存在 → 自动创建 │ └── 网络不可达 → NETWORK_ERROR │
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Vague Triggers

Medium

Confidence: 94% confidence
Finding: The skill description includes broad trigger phrases like '帮我问 ChatGPT', '用 GPT 回答', and '把这段话发给 ChatGPT', which overlap with common user requests and can cause the agent to invoke browser automation when the user may only want an informational answer. Because this skill drives a real logged-in ChatGPT web session, accidental invocation can disclose user content to a third-party service and alter browser/session state without clear user intent.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The skill omits a clear warning that it performs background browser automation, may launch or attach to Chrome, and reuses persisted session data under userdata/. Users may not realize that prompts are being sent through an authenticated web session and that local browser/session state can be modified, which creates privacy and consent risks.

Static analysis

No suspicious patterns detected.