ClawHub
Back to skill

Security audit

Ask Gemini/ChatGPT

Security checks for vulnerabilities and agentic risk

Overview

This skill does what it says: it uses a dedicated Chrome profile to send user-directed prompts to Gemini or ChatGPT and return the results, with some privacy and dependency risks to understand.

Install only if you are comfortable with prompts being sent to Gemini or ChatGPT through a logged-in Chrome profile. Use a dedicated account or profile for this skill, avoid sending secrets or regulated data, keep the Chrome CDP port local, and consider pinning Playwright before rebuilding the virtual environment.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
requirements.txt:1
Finding

Unpinned Playwright Dependency Permits Unreviewed Supply-Chain Updates

Content
View full analysis

Vulnerability Details

File Location: requirements.txt:1
Vulnerability Type: Unpinned third-party dependency without integrity verification
Risk Level: Medium

Vulnerable Code

text
playwright>=1.40.0

The documented installation workflow in SKILL.md:78-81 consumes this requirement directly:

bash
cd {baseDir} && rm -rf .venv && python3 -m venv .venv && .venv/bin/pip install -r requirements.txt

Technical Analysis

The >=1.40.0 constraint permits pip to install any current or future Playwright release satisfying the lower bound. The project provides neither an exact version lock nor package hashes, so the installed dependency can change without corresponding source review.

This creates a supply-chain risk: a compromised upstream release, compromised package-distribution account, or maliciously altered package artifact could be selected during a future environment rebuild. Although the package name is legitimate and there is no evidence that the current Playwright package is malicious, the dependency policy does not ensure reproducible or integrity-verified installations.

The consequence is particularly relevant because both chatbot scripts import Playwright and connect it to an authenticated, persistent Chrome profile. Imported dependency code executes with the invoking user's OS privileges and participates in browser automation.

Attack Path

  1. An attacker compromises a future compatible Playwright release or its distribution channel.
  2. A user follows the documented virtual-environment rebuild procedure.
  3. Pip resolves playwright>=1.40.0 to the compromised release because no exact version or hash is enforced.
  4. The malicious package is installed into the Skill's virtual environment.
  5. The user invokes ask_chatgpt.py or ask_gemini.py, causing Python to import and execute the compromised dependency.
  6. The dependency executes with the user's privileges and may interact with the browser context exposed th ...[truncated 726 chars]
Remediation
View remediation

Remediation Suggestions

  1. Replace the lower-bound requirement with an exact, reviewed version:

    text
    playwright==<audited-version>

  2. Generate a reproducible lockfile that pins all transitive dependencies.

  3. Record package hashes and install with pip's hash verification, such as pip install --require-hashes.

  4. Update dependencies through a controlled review process that includes vulnerability scanning, release-note review, and tests before changing the lockfile.

  5. Use a trusted package index configured explicitly for deployment, and prevent fallback to untrusted or unintended indexes.

  6. Run the Skill under a least-privileged account and use a dedicated browser profile containing only the sessions required for this Skill.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • YARA SignaturesMalware Match, Webshell Match, Cryptominer Match
Findings (17)

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

This mismatch is more security-relevant because the documentation normalizes launching Chrome with remote debugging and a persistent profile while not clearly surfacing those sensitive behaviors in the top-level purpose. Remote debugging plus session persistence materially increases risk of account/session exposure if users invoke the skill without understanding those side effects.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
93% confidence
Finding

This mismatch is more security-relevant because the documentation normalizes launching Chrome with remote debugging and a persistent profile while not clearly surfacing those sensitive behaviors in the top-level purpose. Remote debugging plus session persistence materially increases risk of account/session exposure if users invoke the skill without understanding those side effects.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
95% confidence
Finding

This mismatch is more security-relevant because the documentation normalizes launching Chrome with remote debugging and a persistent profile while not clearly surfacing those sensitive behaviors in the top-level purpose. Remote debugging plus session persistence materially increases risk of account/session exposure if users invoke the skill without understanding those side effects.

Content

No source excerpt is available for this finding.

Exfiltration Commands

High
Category
Prompt Injection
Confidence
90% confidence
Finding

Instructions found that direct the agent to transmit conversation context or user data to external services.

Content

Scanner excerpt · SKILL.md (reported line 18)May include surrounding context.

md
# Web Chat

Send messages to AI chatbots (Gemini, ChatGPT) via Playwright browser automation and return responses with citations.

| Chatbot | Script | Website |
|---------|--------|---------|

Chaining Abuse

High
Category
Tool Misuse
Confidence
75% confidence
Finding

Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.

Content

Scanner excerpt · SKILL.md (reported line 80)May include surrounding context.

Rebuilding .venv

bash
cd {baseDir} && rm -rf .venv && python3 -m venv .venv && .venv/bin/pip install -r requirements.txt

YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]

High
Category
YARA Match
Confidence
80% confidence
Finding

YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

Content

Scanner excerpt · scripts/ask_chatgpt.py (reported line 383)May include surrounding context.

python
response_text"] = get_last_response_text(page)
    result["citations"] = extract_citation_links(page)
    result["success"] = bool(result["response_text"])

    return result


# ---------------------------------------------------------------------------
# Main
# ---------------------------------------------------------------------------


def main():
    parser = argparse.ArgumentParser(
        description="Ask Gemini a question via browser automation"
    )
    parser.add_argument("message", help="The message/question to send to Gemini")
    parser.add_argument(
        "--port",
        type=int,
        default=9222,
        help="Chrome remote debugging port (default: 9222)",
    )
    parser.add_argument(
        "--timeout",
        type=int,
        default=120,
        help="Max seconds to wait for response (default: 120)",
    )
    parser.add_argument(
        "--new-chat",
        action="store_true",
        help="Force start a new chat session",
    )
    parser.add_argu

YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]

High
Category
YARA Match
Confidence
80% confidence
Finding

YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

Content

Scanner excerpt · scripts/ask_gemini.py (reported line 360)May include surrounding context.

python
response_text"] = get_last_response_text(page)
    result["citations"] = extract_citation_links(page)
    result["success"] = bool(result["response_text"])

    return result


# ---------------------------------------------------------------------------
# Main
# ---------------------------------------------------------------------------


def main():
    parser = argparse.ArgumentParser(
        description="Ask Gemini a question via browser automation"
    )
    parser.add_argument("message", help="The message/question to send to Gemini")
    parser.add_argument(
        "--port",
        type=int,
        default=9222,
        help="Chrome remote debugging port (default: 9222)",
    )
    parser.add_argument(
        "--timeout",
        type=int,
        default=120,
        help="Max seconds to wait for response (default: 120)",
    )
    parser.add_argument(
        "--new-chat",
        action="store_true",
        help="Force start a new chat session",
    )
    parser.add_argu

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
93% confidence
Finding

The skill invokes local shell scripts and browser automation that reach external services, but the manifest does not declare any explicit tool scope or permissions boundaries. This increases the chance of unintended execution with broader-than-expected capabilities and makes review and policy enforcement harder.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The skill sends user queries to third-party AI services, but the description does not clearly warn users that their prompt content leaves the local environment. This creates a real privacy and data-handling risk, especially if users provide sensitive, regulated, or proprietary information assuming the skill is local-only.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

Using a persistent Chrome profile with retained login sessions is a sensitive behavior that should be clearly disclosed because it can expose authenticated accounts and browser state to automation. In this skill's context, browser automation attached to a saved profile materially increases the consequences of misuse or compromise beyond a stateless request relay.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The script sends arbitrary user-provided content to ChatGPT using an already logged-in browser session without any explicit consent, warning, or confirmation about external transmission and account-context reuse. In this skill context, that is more dangerous because users may assume a local tool action while the automation actually transmits potentially sensitive prompts to a third-party service under the operator's authenticated account.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The script sends arbitrary user-provided prompts to gemini.google.com using an already logged-in Chrome context, but provides no explicit warning or consent step about external transmission or account-context use. In an agent setting, this can cause unintended disclosure of sensitive prompts or use of a personal/corporate Google account without the operator fully realizing it.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Low
Category
Not specified by scanner
Confidence
95% confidence
Finding

The manifest description at L03 claims the skill sends the user's query and returns the chatbot response verbatim. The body documentation at L18 instead says it returns responses 'with citations,' which adds output content not described in the manifest and conflicts with the later instruction to return full unmodified text.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
95% confidence
Finding

The dependency is specified with a lower-bound constraint only, which allows future unreviewed Playwright versions to be installed. This creates supply-chain and stability risk because a compromised, breaking, or vulnerable upstream release could be pulled into the skill without explicit approval or testing.

Content

Scanner excerpt · requirements.txt (reported line 1)May include surrounding context.

text
playwright>=1.40.0

Description-Behavior Mismatch

Low
Category
Not specified by scanner
Confidence
93% confidence
Finding

The manifest says the skill sends the user's query to Gemini/ChatGPT and returns the response verbatim. This script also parses the response DOM for outbound citation/source links and includes them in output, which is additional behavior not described in the manifest.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Low
Category
Not specified by scanner
Confidence
95% confidence
Finding

The manifest says the skill sends the user's query to Gemini or ChatGPT and returns the response verbatim. This script additionally parses the page for citation links and includes them in output, which is extra behavior not described in the skill's stated scope.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Low
Category
Not specified by scanner
Confidence
81% confidence
Finding

The manifest frames the skill as relaying a user query to the chatbot and returning the response. Supporting --new-chat changes conversation state by starting a fresh session, which is broader than the narrowly described send-and-return behavior.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.