T09 · Insecure Skill Coding Practices
Error
- Location
scripts/launch-chrome-debug.sh:5- Finding
Authenticated Default Chrome Profile Exposed Through Remote Debugging
- Content
View full analysis
- Remediation
View remediation
Security audit
Social Media Dashboard
Security checks for vulnerabilities and agentic risk
Overview
The skill has a coherent analytics-dashboard purpose, but it asks for broad browser/session access to private creator and revenue data with under-scoped credential and debugging workflows.
Install only if you are comfortable letting the agent/browser read logged-in creator dashboards that may include revenue and account analytics. Avoid the Chrome remote-debugging helper with your normal browser profile, do not paste raw cookies into chat or terminals, review/redact collected data before sharing it, and delete any local history or session material you do not need.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T09 · Insecure Skill Coding Practices
Warning
- Location
platforms/toutiao.md:50- Finding
Raw Authentication Cookie Collection and Replay Workflow
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (16)
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The skill instructs the agent to open creator dashboards, check login state, and extract page text from logged-in pages containing follower metrics, performance data, and income information, but it does not present a clear upfront warning about this level of browser automation and sensitive data collection. Because the workflow uses AppleScript and JavaScript execution in the browser, users may not realize the skill can read private account analytics and earnings pages once permission is granted.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
This skill automates Chrome/Safari to access Zhihu creator analytics and income pages, then extracts
document.body.innerTextfrom an already logged-in session. That enables access to sensitive business and financial information, but the description does not prominently disclose the sensitivity of the data being read or require explicit informed consent before collection.- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The skill description and all user-facing instructions are presented only in Chinese, and the expected user replies such as “好了” and “登录好了” are language-specific. This can function as a de facto forced language policy without user opt-in or an explicit statement that the skill is intended only for Chinese-language creator platforms.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The trigger list includes broad phrases such as '我的自媒体数据' and '生成自媒体数据周报', which can match ordinary requests and cause the skill to activate outside a narrow, clearly understood context. In this skill, activation can lead to browser automation against logged-in creator dashboards and extraction of sensitive analytics and income data, so overbroad triggers materially increase the chance of unintended data access.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill automates Chrome/Safari to access authenticated backend pages containing sensitive creator analytics, income, and fan metrics, yet the description does not prominently warn the user that browser automation will read data from their existing logged-in session. This omission increases the chance of uninformed consent and unexpected disclosure of sensitive account information to the agent workflow.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The skill’s activation is effectively tied to a generic user request to 'view CSDN data' and then proceeds to drive the browser into authenticated creator-center pages and extract account analytics. Because the scope is not narrowly constrained or paired with an explicit confirmation step, it can cause collection of sensitive account/business metrics beyond what a user may expect from a loosely phrased request.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The trigger condition '当用户请求查看知乎数据时' is overly broad for a skill that drives a logged-in browser session and reads creator analytics and income pages. Without a narrowly scoped invocation phrase and explicit consent gate, the skill could be activated in ambiguous contexts and collect sensitive account and revenue data the user did not clearly intend to expose.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The skill explicitly instructs the user to paste account analytics data into an AI after collecting it from an authenticated dashboard, but provides no privacy warning, data minimization guidance, or consent boundary. This creates a real risk of oversharing potentially sensitive business/account information to an external AI system, especially because the script also copies the data to the clipboard to streamline exfiltration.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The script drives a logged-in Chrome session via AppleScript and extracts document.body.innerText from sensitive Toutiao creator pages, which may include account analytics, earnings, and other private data. Because it reuses an existing authenticated browser context and prints the harvested content to stdout without a clear disclosure or consent step, it creates a real risk of unintended data exposure to logs, parent processes, or downstream tools.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The script’s comments and all user-facing prompts are written exclusively in Chinese, including the required response phrase on L35. For a general-purpose launcher, this imposes a language choice on users without opt-in or any documented region-specific justification, which matches the language/locale policy violation criteria.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
This manifest contains user-facing descriptive text only in Chinese, which can impose a language constraint without user opt-in or an explicit statement that the skill is intended for a Chinese-speaking audience. Under the policy, forcing a specific language without choice or documented justification is a natural-language policy concern.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
The skill explicitly instructs storing collected account metrics in local history for trend analysis, but it does not clearly state retention limits, deletion behavior, or how users can control persistence. Even though the data is less sensitive than raw credentials and the document says data stays local, persistent storage of account analytics can still create privacy and data-minimization risks if the host system is shared, compromised, or backed up unexpectedly.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
All user-facing instructions in the file are in Chinese, and there is no indication that the user can choose another language or that the skill is intentionally limited to a Chinese-speaking audience for a documented regional reason. This can violate language or locale policy when a skill forces a specific language without user opt-in.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
All natural-language comments and runtime messages in the script are in Chinese, with no indication that language is configurable or intentionally limited to a China-specific audience. Under the stated policy, forcing a specific language without user choice is a natural-language policy concern.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The entire template, including headings and labels, is written in Chinese, which implies the generated report will be presented in a fixed language. This can violate language/locale policy when the skill does not offer a user choice or document that the skill is intentionally region-specific.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The markdown template is entirely written in Chinese, including headings, labels, and notices, with no indication that language selection is optional or configurable. Under the policy criteria, hard-coding a specific language without user opt-in is a natural-language locale policy issue.
- Content
Static analysis
No suspicious patterns detected.