Security audit

X News Crawler

Security checks for vulnerabilities and agentic risk

Overview

This X/Twitter crawler appears purpose-aligned, but it asks for broader browser and package-install access than the task needs.

Review before installing. Use a dedicated Chrome profile or separate low-privilege browser account instead of your everyday Chrome profile, bind CDP to localhost, close the debugging browser after use, and avoid running global unpinned package installs or broad build approvals unless you trust and have reviewed the package source/version.

A.I.G

Vulnerability Patterns

Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Error

Location: SKILL.md:12
Finding: Unpinned Global Dependency Installation with Broad Build-Script Approval
Content: View full analysis
Remediation: View remediation
``` 2. Declare it as a project-local dependency and commit a lockfile so dependency resolution is reproducible. 3. Use package-manager integrity verification and validate the package provenance, publisher identity, and release signatures where available. 4. Review all lifecycle and build scripts before approval. 5. Approve only the specific reviewed package instead of broadly approving pending global builds. 6. Run the package in a restricted environment, such as a dedicated container or low-privilege account, with only the files and network destinations needed for the crawl. 7. Add automated dependency scanning and require explicit review before changing the pinned version or lockfile. 8. Document the exact supported package version and hash in both `SKILL.md` and `references/cli.md`. ]]>

T05 · Unauthorized Access and Privilege Escalation

Error

Location: SKILL.md:19
Finding: Regular Authenticated Chrome Profile Exposed Through the DevTools Protocol
Content: View full analysis
/dev/null 2>&1; then return 0 fi cat >&2 <
Remediation: View remediation
``` 2. Reverse the current instruction that prohibits `--user-data-dir`; isolation should be required rather than discouraged. 3. Bind the debugging interface explicitly to `127.0.0.1`. 4. Prefer a random or ephemeral port instead of the predictable fixed port `9333`. 5. Validate `--cdp` input and reject non-loopback URLs by default. Require explicit, documented user authorization for remote endpoints. 6. Close the debugging-enabled browser immediately after the crawl. 7. Do not use the isolated profile for email, administration, banking, or unrelated authenticated applications. 8. Run the crawler and browser under a dedicated low-privilege operating-system account or sandbox where practical. 9. Warn users that CDP grants broad browser control and should not remain enabled during ordinary browsing. 10. If supported by the automation tool, connect only to a dedicated browser instance or target rather than a regular multi-purpose browser session. ]]>

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 92% confidence
Finding: The skill instructs the agent to perform network-capable crawling through a local CLI, but it declares no explicit tool scope such as allowed-tools or permissions. That creates an authorization ambiguity where a runner may permit broader-than-intended network access or execute the skill without clear operator review of its external communication behavior.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The skill explicitly tells the user to launch Chrome with remote debugging on their regular profile and says not to use an isolated user-data-dir, but it omits a clear warning about the privacy and security consequences. Using a regular profile exposes authenticated sessions, cookies, browsing data, and potentially sensitive account access to any process that can speak to the local CDP port or drive the browser during crawling.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 87% confidence
Finding: The skill metadata is broadly worded and lacks clear activation boundaries, so an agent may invoke it for loosely related requests involving X/Twitter, scraping, or news collection without strong user confirmation. Because this skill drives a local CLI/browser wrapper to crawl external content, overbroad triggering increases the chance of unintended browsing, data collection, or policy-violating automation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The metadata forces Chinese-language behavior in the short description and default prompt without indicating that this should depend on the user's language preference. While not directly enabling code execution or exfiltration, it can cause the agent to disregard user intent, degrade transparency, and produce outputs the user cannot verify, which is riskier in a scraping workflow where accurate review of collected content matters.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The documentation instructs users to enable Chrome remote debugging on their regular browser profile and explicitly discourages using an isolated profile. A CDP-enabled regular profile can expose authenticated sessions, browsing data, cookies, and active tabs to local tools or other processes that can reach the debugging endpoint, increasing the blast radius if the crawler or host is compromised.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 77% confidence
Finding: This code creates parent directories and overwrites the specified output path with JSON results, which is a file-write operation. While the --output flag implies writing, there is no confirmation prompt, user-facing notice at write time, or explanatory comment/docstring warning about the overwrite behavior in this file.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.