ClawHub
Back to skill

Security audit

Agent Reach Local

Security checks for vulnerabilities and agentic risk

Overview

The skill’s broad web-access purpose is coherent, but it asks agents to use browser cookies, mutable remote setup instructions, global installs, and anti-bot bypasses without enough user control.

Review this skill carefully before installing. Use it only when you are comfortable with an agent accessing social platforms and web services, and require explicit approval before any cookie use, login setup, public posting, proxy configuration, Docker/package installation, or use of a third-party URL reader. Avoid giving it personal browser profiles or reusable cookies unless you have isolated accounts/profiles and understand the session risk.

A.I.G

Vulnerability Patterns
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (4)

T05 · Unauthorized Access and Privilege Escalation

Error
Location
SKILL.md:73
Finding

Unscoped Access to Chrome Browser Cookies

Content
View full analysis
Server IPs may get 412. Use `--cookies-from-browser chrome` or configure proxy. ``` ### Technical Analysis The suggested `--cookies-from-browser chrome` option directs `yt-dlp` to read authentication cookies from a Chrome browser profile. A general browser profile can contain active sessions for Bilibili and unrelated services. The instruction does not require explicit user consent, select a dedicated browser profile, restrict cookie extraction to a specific domain, or define controls for handling the extracted credentials. This violates least-privilege principles because a troubleshooting operation for one platform can grant the invoked process access to a broader browser credential store. ### Attack Path 1. A Bilibili request fails with an HTTP 412 response. 2. The agent follows the troubleshooting instruction and runs `yt-dlp` with `--cookies-from-browser chrome`. 3. The tool accesses Chrome's cookie database and any necessary local decryption facilities. 4. Authentication cookies available to the selected browser profile are exposed to the invoked process. 5. A compromised dependency, tool, or execution environment could misuse the accessible session data. ### Impact Assessment The invoked tool may obtain access to authenticated browser sessions held in the selected Chrome profile. The scope depends on the browser profile and local operating-system protections, but it may extend beyond the platform involved in the request. Misused session cookies could permit account access with the same effective privileges as the affected browser sessions. ]]>
Remediation
View remediation

T08 · Insecure Dependencies

Warning
Location
SKILL.md:159
Finding

Unpinned Global npm Dependency Installation

Content
View full analysis
Remediation
View remediation

T08 · Insecure Dependencies

Error
Location
SKILL.md:161
Finding

Setup Delegated to a Mutable Remote Installation Guide

Content
View full analysis
Remediation
View remediation

other

Warning
Location
SKILL.md:38
Finding

Disclosure of User-Supplied URLs to an External Reader Service

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Rogue AgentSelf-Modification, Session Persistence
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • YARA SignaturesMalware Match, Webshell Match, Cryptominer Match
Findings (6)

Vague Triggers

High
Category
Not specified by scanner
Confidence
96% confidence
Finding

The trigger list includes very broad everyday phrases like 'research', 'find information', and 'web search', which can cause the skill to activate in many unrelated contexts. Because this skill can access external sites, proxies, cookies, and posting workflows, over-broad invocation materially increases the chance of unintended network actions or account-affecting operations.

Content

No source excerpt is available for this finding.

YARA rule 'info_stealer': Information stealer patterns (credential harvesting, browser data theft) [malware]

High
Category
YARA Match
Confidence
83% confidence
Finding

The guidance to use '--cookies-from-browser chrome' instructs the tool to pull authenticated browser cookies directly from a local browser profile. Even if intended for convenience, this resembles credential extraction behavior and can expose active session tokens to the agent or downstream tools without adequate warning or controls.

Content

Scanner excerpt · SKILL.md (reported line 73)May include surrounding context.

L" # download subtitles, then read the .vtt file yt-dlp --dump-json "ytsearch5:query" # search

text

## Bilibili (yt-dlp)

```bash
yt-dlp --dump-json "https://www.bilibili.com/video/BVxxx"
yt-dlp --write-sub --write-auto-sub --sub-lang "zh-Hans,zh,en" --convert-subs vtt --skip-download -o "/tmp/%(id)s" "URL"

Server IPs may get 412. Use --cookies-from-browser chrome or configure proxy.

Reddit

bash
curl -s "https://www.reddit.com/r/SUBREDDIT/hot.json?limit=10" -H "User-Agent: agent-reach/1.0"
curl -s "https://www.reddit.com/search.json?q=QUERY&limit=10" -H "User-Agent: agent-reach/1.0"

Server IPs may get 403. Search via Exa instead, or configure proxy.

GitHub (gh CLI)

bash
gh search repos "query" --sort stars --limit 10
gh repo view owner/repo
gh search code "query" --language python
gh issue list -R owner/repo --state open
gh issue view 123 -R owner/repo

小红书 / XiaoHongShu (mcporter)

bas

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The description says the skill should be used when users ask to 'post, comment, or interact' on supported platforms, but it provides no warning about account-affecting consequences. Without clear consent and confirmation requirements, an agent could take irreversible or reputation-impacting actions on behalf of a user.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
77% confidence
Finding

The skill directs persistent data to ~/.agent-reach/, establishing a persistence location outside the normal workspace. In an agent setting, persistent storage can retain tokens, cookies, browsing artifacts, or scraped data across sessions, increasing the blast radius of compromise or accidental data reuse.

Content

Scanner excerpt · SKILL.md (reported line 33)May include surrounding context.

md
## ⚠️ Workspace Rules

**Never create files in the agent workspace.** Use `/tmp/` for temporary output and `~/.agent-reach/` for persistent data.

## Web — Any URL

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The skill instructs users to import cookies for XiaoHongShu login but does not warn that cookies are sensitive authentication material equivalent to session credentials. This can lead users or agents to handle, store, or transmit reusable account access tokens insecurely.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill explicitly recommends using a browser automation path that 'bypasses WeChat anti-bot' protections. That goes beyond ordinary content retrieval guidance and can encourage evasion of platform access controls, creating legal, policy, and abuse risk if an agent uses it automatically.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.