ClawHub
Back to skill

Security audit

Agent Reach

Security checks for vulnerabilities and agentic risk

Overview

This skill has a clear internet-access purpose, but it asks the agent to install mutable remote tools and handle sensitive account cookies.

Review this carefully before installing. Use it only in an isolated environment, avoid pasting real account cookies into chat or shell history, prefer throwaway accounts, verify the upstream package source, and require explicit confirmation before any posting, liking, commenting, or other account-changing action.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T03 · Remote Payload Retrieval and Execution

Error
Location
SKILL.md:33
Finding

Installation and Execution of Mutable Remote Code

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, line 33
Vulnerability Type: Remote payload retrieval and insecure dependency installation
Risk Level: High

bash
pip install https://github.com/Panniantong/agent-reach/archive/main.zip

Technical Analysis

The installation command retrieves a Python package directly from the mutable main branch of a personal GitHub repository. It does not pin an immutable release, commit hash, package digest, or cryptographic signature.

Installing a remote Python package can execute package build and installation logic. Consequently, the effective code executed by this Skill can change after the Skill itself has been reviewed. The later documented invocation of agent-reach install --env=auto further expands the supply-chain surface by installing multiple additional tools and runtimes.

The external network access is necessary for the Skill's installer functionality, but retrieving executable code from a mutable branch is not the minimum privilege or trust necessary to provide that functionality. An immutable, verified artifact would achieve the same purpose with substantially less risk.

Attack Path

  1. An attacker compromises the upstream GitHub account, repository, or main branch, or a malicious upstream change is accepted.
  2. The user or Agent runs the documented pip install command.
  3. pip downloads the current repository archive rather than a previously reviewed version.
  4. Malicious packaging or module code executes during installation or subsequent invocation.
  5. The payload operates with the privileges of the user running the Agent and can access resources available to that account.

Impact Assessment

Successful exploitation can result in arbitrary code execution with the Agent user's privileges. Depending on the local environment, this could expose user files, browser data, API credentials, platform cookies, Agent configuration, SSH credenti ...[truncated 370 chars]

Remediation
View remediation

Remediation Suggestions

  1. Pin the dependency to a reviewed, immutable release or full Git commit hash rather than main.
  2. Download a versioned artifact and verify its SHA-256 digest before installation.
  3. Use pip --require-hashes with a locked dependency manifest where feasible.
  4. Publish verified releases through a controlled package registry and use signed release artifacts.
  5. Pin and audit all transitive dependencies installed by agent-reach install.
  6. Display the complete installation plan and obtain explicit user approval before installing runtimes, global command-line tools, or system packages.
  7. Run installation in an isolated virtual environment or container with restricted filesystem and network access.
  8. Disable automatic update behavior unless updates are immutable, authenticated, and explicitly approved.

T05 · Unauthorized Access and Privilege Escalation

Warning
Location
SKILL.md:48
Finding

Unsafe Collection and Handling of Browser Authentication Cookies

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 48–50 and 66–75
Vulnerability Type: Excessive browser credential access and plaintext secret handling
Risk Level: Medium

bash
agent-reach configure twitter-cookies "auth_token=xxx; ct0=yyy"
agent-reach configure proxy http://user:pass@ip:port
agent-reach configure --from-browser chrome

The later cookie-import instructions also direct users to export a complete cookie header string and provide it to the Agent.

Technical Analysis

Authentication cookies are bearer credentials. A party that obtains a valid session cookie may be able to impersonate the account without knowing its password or completing the original login flow.

Supplying cookies and proxy credentials directly as command-line arguments can expose them through shell history, terminal transcripts, process inspection, Agent execution logs, or telemetry. Asking users to provide complete exported cookie strings to the Agent similarly risks retaining credentials in conversation history and logs.

The --from-browser chrome operation is especially sensitive because accessing a browser profile may expose a credential store broader than the single platform required for the current task. The documentation does not establish domain scoping, consent boundaries, storage protections, redaction requirements, or deletion procedures.

Authenticated access may be necessary for some declared platform functions, but collecting complete cookies through chat or broadly extracting them from a browser exceeds the minimum safe privilege needed. Platform-scoped OAuth or a local secret-handling workflow would provide narrower access.

Attack Path

  1. A user follows the Skill and either places credentials in a command argument, exports a complete cookie header to the Agent, or permits browser-profile extraction.
  2. The secret is retained in shell history, process metadata, Agent logs, chat history, configur ...[truncated 1280 chars]
Remediation
View remediation

Remediation Suggestions

  1. Prefer official, platform-scoped OAuth authorization with the narrowest available permissions.
  2. Never ask users to paste authentication cookies into an Agent conversation.
  3. Replace command-line secret arguments with a protected interactive prompt, standard input, or an operating-system credential manager.
  4. Require explicit informed consent immediately before accessing a browser profile.
  5. Restrict browser extraction to the exact requested domain and cookie names; do not enumerate unrelated browser credentials.
  6. Store credentials in an OS keychain or encrypted secret store, with filesystem permissions restricted to the current user.
  7. Redact cookies, authorization headers, proxy passwords, and tokens from command output, health checks, exceptions, telemetry, and logs.
  8. Avoid retaining secrets in shell history or process arguments and securely delete temporary secret material.
  9. Document credential lifetime, storage location, revocation procedures, and deletion behavior.
  10. Require separate confirmation before any authenticated state-changing operation, such as publishing content.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Rogue AgentSelf-Modification, Session Persistence
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • YARA SignaturesMalware Match, Webshell Match, Cryptominer Match
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (9)

YARA rule 'agent_skill_remote_bootstrap_execution': Remote script or code download followed by execution/bootstrap installation [agent_skills]

High
Category
YARA Match
Confidence
96% confidence
Finding

The skill directs the agent to pip install directly from a GitHub archive URL, which executes remote code from an unpinned branch/archive without normal package index controls or integrity verification. This is a classic supply-chain/bootstrap risk, especially dangerous because the installed package then auto-installs additional tooling and manages tokens, proxies, and platform integrations.

Content

Scanner excerpt · SKILL.md (reported line 33)May include surrounding context.

iles, clone repos, or write output in the agent workspace.** Use these directories instead:

PurposeDirectory
Temporary output (subtitles, downloads)/tmp/
Upstream tool repos~/.agent-reach/tools/
Config & tokens~/.agent-reach/

Violating this will pollute the user's workspace and degrade their agent experience over time.

Setup

bash
pip install https://github.com/Panniantong/agent-reach/archive/main.zip
agent-reach install --env=auto
agent-reach doctor

install auto-detects your environment and installs core dependencies (Node.js, mcporter, xreach CLI, gh CLI, yt-dlp, feedparser). Run doctor to see what's active.

Management

bash
agent-reach doctor        # channel status overview
agent-reach watch         # quick health + update check
agent-reach check-update  # check for new versions

Configure channels

bash
agent-reach configure twitter-cookies "auth_token=xxx; ct0=yyy"
agent-reach configure p

Missing User Warnings

High
Category
Not specified by scanner
Confidence
97% confidence
Finding

The skill instructs users to export and send raw cookie header strings to the agent, which are effectively bearer credentials for logged-in sessions. Exposing those values to the agent or chat transcript can enable account takeover, session hijacking, and reuse of highly privileged authentication artifacts across supported platforms.

Content

No source excerpt is available for this finding.

YARA rule 'info_stealer': Information stealer patterns (credential harvesting, browser data theft) [malware]

High
Category
YARA Match
Confidence
95% confidence
Finding

The documented use of --cookies-from-browser chrome instructs tooling to extract authentication material directly from the local browser profile. Even if intended for convenience, this is highly sensitive behavior because it accesses stored session credentials and can expose them to the agent process, logs, or downstream tools, functionally resembling credential harvesting.

Content

Scanner excerpt · SKILL.md (reported line 130)May include surrounding context.

o "/tmp/%(id)s" "URL"

Then read the .vtt file

Search (yt-dlp ytsearch)

yt-dlp --dump-json "ytsearch5:query"

If "no JS runtime" warning: ensure Node.js is installed, then run:

mkdir -p ~/.config/yt-dlp && echo "--js-runtimes node" >> ~/.config/yt-dlp/config

text

### Bilibili (yt-dlp)

> ⚠️ 服务器 IP 可能被 Bilibili 拦截（412 错误）。建议通过代理访问，或加 `--cookies-from-browser chrome`。

```bash
# Get video metadata
yt-dlp --dump-json "https://www.bilibili.com/video/BVxxx"

# Download subtitles
yt-dlp --write-sub --write-auto-sub --sub-lang "zh-Hans,zh,en" --convert-subs vtt --skip-download -o "/tmp/%(id)s" "URL"

# If blocked (412 / login required):
yt-dlp --cookies-from-browser chrome --dump-json "URL"

Reddit (JSON API)

bash
# Read a subreddit
curl -s "https://www.reddit.com/r/python/hot.json?limit=10" -H "User-Agent: agent-reach/1.0"

# Read a post with comments
curl -s "https://www.reddit.com/r/python/comments/POST_ID.json" -H

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The trigger phrases are broad and loosely specified, which increases the likelihood that the skill activates on ambiguous requests such as generic 'install' or 'configure' language. In this context, unintended activation is risky because the skill can install software, configure proxies, and enable access to third-party accounts and web content.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill is presented as a setup/configuration tool, but its documented downstream use includes direct account actions such as publishing content and interacting with third-party platforms. That expands the privilege and action surface beyond what a user may reasonably expect from 'install/configure channel access tools,' increasing the chance of unintended or unauthorized external actions.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
78% confidence
Finding

The skill claims agent-reach itself does not fetch content, yet immediately instructs the agent to use directly installed upstream tools for reading and acting on external platforms. This mismatch can mislead operators about the effective capability of the skill and may cause them to approve a tool they believe is lower risk than it actually is.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
71% confidence
Finding

Appending configuration into ~/.config/yt-dlp/config creates persistent user-level state that survives the session and may affect future runs outside the immediate task. In an agent skill, persistent changes can be risky because they are easy to forget, can silently alter later behavior, and may combine with other tooling to broaden long-term access.

Content

Scanner excerpt · SKILL.md (reported line 125)May include surrounding context.

yt-dlp --dump-json "ytsearch5:query"

If "no JS runtime" warning: ensure Node.js is installed, then run:

mkdir -p ~/.config/yt-dlp && echo "--js-runtimes node" >> ~/.config/yt-dlp/config

text

### Bilibili (yt-dlp)

Rp1

Medium
Category
MCP Rug Pull
Confidence
83% confidence
Finding

The skill invokes npx mcporter without pinning a specific version, which allows execution of whatever package version is current at runtime. In a security-sensitive installer skill that configures access to many upstream services, this creates a supply-chain risk because a compromised or breaking upstream release could be fetched and executed unexpectedly.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
74% confidence
Finding

The file includes Chinese-only trigger phrases and multiple Chinese-only instruction sections inside an otherwise English skill description. This can impose a language expectation on users without opt-in or justification, which may conflict with organizational language or locale policies.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.