ClawHub
Back to skill

Security audit

GPT Web Chat Skill

Security checks for vulnerabilities and agentic risk

Overview

This skill openly aims to automate ChatGPT in a browser, but it relies on missing runtime scripts and may reuse a logged-in browser session in the background.

Review before installing. Use this only when you intentionally want prompts sent to chatgpt.com through a browser session, and avoid sensitive content unless you are comfortable with that session reuse. The package should include or clearly pin the runtime scripts it tells the agent to execute, plus clear first-use confirmation and cleanup guidance for stored browser session data.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 46)May include surrounding context.

md
chat.py
  │
  ├── Stage 1: 环境
  │   ├── .env 不存在 → ENV_NOT_FOUND
  │   ├── userdata/ 不存在 → 自动创建
  │   └── 网络不可达 → NETWORK_ERROR
  │

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The skill description includes broad trigger phrases like '帮我问 ChatGPT', '用 GPT 回答', and '把这段话发给 ChatGPT', which overlap with common user requests and can cause the agent to invoke browser automation when the user may only want an informational answer. Because this skill drives a real logged-in ChatGPT web session, accidental invocation can disclose user content to a third-party service and alter browser/session state without clear user intent.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The skill omits a clear warning that it performs background browser automation, may launch or attach to Chrome, and reuses persisted session data under userdata/. Users may not realize that prompts are being sent through an authenticated web session and that local browser/session state can be modified, which creates privacy and consent risks.

Content

No source excerpt is available for this finding.