Security audit

MemoleCard-zh

Security checks for vulnerabilities and agentic risk

Overview

This skill automates a card-download workflow but includes unsafe fallback behavior that can send browser cookies to an arbitrary server and can delete matching files from Downloads.

Review this skill before installing. It may submit your article content to moccard.com, use your active browser session, and in fallback mode send readable cookies and card identifiers to the configured backup server. Only use it if you fully trust that backup endpoint and accept the risk of matching ZIP files in Downloads being removed.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (3)

other

Error

Location: SKILL.md:124
Finding: Browser Session Cookies Exfiltrated to an Arbitrary Backup Server
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.md:102
Finding: Unrelated Archives Are Deleted from the User's Downloads Directory
Content: View full analysis
/dev/null ``` ### Technical Analysis The script uses the user's general Downloads directory as working storage and deletes every file matching `images-*.zip` before monitoring for a new download. The matching files are not verified as having been created by this skill or by the current invocation. The quoted expansion still allows pathname expansion because the wildcard is contained in the variable value used within the larger shell word. Consequently, all matching archives in `$HOME/Downloads` can be passed to `rm -f`. Suppressing errors also makes the destructive operation less visible. This violates least-destructive-operation principles and unnecessarily places temporary workflow state in a shared directory containing user-owned files. ### Attack Path 1. The user has one or more unrelated files named according to the `images-*.zip` pattern in `$HOME/Downloads`. 2. The primary download-link capture method fails to produce a URL. 3. The local file-monitoring fallback executes. 4. `rm -f` expands the pattern and deletes all matching archives without confirmation or ownership validation. 5. The deleted files may be unrecoverable through ordinary means. ### Impact Assessment The vulnerability can cause silent loss of unrelated user archives accessible to the account running the skill. Its scope is limited to files matching `images-*.zip` in the configured Downloads directory, but every matching file can be removed. It does not provide additional system privileges to an attacker, although it can destroy user data under the skill's existing filesystem p ...[truncated 15 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Note

Location: SKILL.md:65
Finding: Unvalidated Style Index Can Inject Additional Browser CLI Arguments
Content: View full analysis
Remediation: View remediation
&2 exit 1 fi ``` 2. Enforce an appropriate upper bound based on the number of available styles. 3. Quote every variable passed as a command argument: ```bash agent-browser --session "$SESSION_NAME" find nth "$STYLE_INDEX" ".style-item" click ``` 4. Apply equivalent allowlist validation and quoting to all other template-controlled values before passing them to command-line tools. ]]>

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (5)

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 85% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · SKILL.md (reported line 99)May include surrounding context.
md
if [ -z "$DOWNLOAD_URL" ]; then echo "🔍 监控本地下载文件..." # 清空旧文件 rm -f "$DOWNLOAD_PATH/$ZIP_PATTERN" 2>/dev/null # 点击打包下载 agent-browser --session $SESSION_NAME find \ text "打包下载" \

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The fallback flow reads browser session cookies and sends them to a user-supplied backup server via curl. This is direct credential/session exfiltration that can let the receiving server hijack authenticated sessions or impersonate the user against the original site.
Content: No source excerpt is available for this finding.

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The skill transmits active browser cookies to a server endpoint without any explicit disclosure or consent. Even if framed as a backup download mechanism, this grants the remote endpoint access to authenticated session material and materially expands the trust boundary beyond the original website.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: Natural-language instructions, prompts, and UI assumptions in this file are exclusively Chinese, and the skill does not indicate that language selection is optional or limited to a China-specific deployment. That can violate language/locale policy where users must be given a choice or a clear justification for a fixed locale.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 85% confidence
Finding: The script claims to open an official site, but the configured domain and later naming/logic suggest a mismatch that could mislead users about where their content is being sent. In a browser-automation skill that submits long user-provided content, this increases phishing and data-routing risk because sensitive text may be posted to an unintended service.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.