Security audit

Agent Reach

Security checks for vulnerabilities and agentic risk

Overview

This skill mostly matches its web-search purpose, but it gives agents broad setup, cookie, posting, and mutable remote-instruction authority without enough safeguards.

Install only if you are comfortable with a skill that can send searches and URLs to external services, use platform tools, handle cookies, and potentially post through authenticated accounts. Before use, require explicit confirmation for posting, cookie import/browser-cookie extraction, package installation, Docker or proxy setup, and any fetched remote setup instructions.

A.I.G

Vulnerability Patterns

Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T08 · Insecure Dependencies

Warning

Location: SKILL.md:196
Finding: Unpinned Global npm Dependency Installation
Content: View full analysis
Remediation: View remediation

T03 · Remote Payload Retrieval and Execution

Error

Location: SKILL.md:199
Finding: Mutable Remote Setup Guide Can Introduce Unreviewed Execution Instructions
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Rogue AgentSelf-Modification, Session Persistence
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
YARA SignaturesMalware Match, Webshell Match, Cryptominer Match
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (17)

Vague Triggers

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The trigger list includes broad everyday phrases such as 'search online', 'research', and '帮我查', which can cause the skill to activate for routine requests that do not clearly require this powerful internet-enabled tool. In context, unintended invocation is more dangerous because the skill can perform external web requests and platform interactions, increasing the chance of unnecessary data exposure or unexpected actions.
Content: No source excerpt is available for this finding.

YARA rule 'info_stealer': Information stealer patterns (credential harvesting, browser data theft) [malware]

High

Category: YARA Match
Confidence: 90% confidence
Finding: The recommendation to use '--cookies-from-browser chrome' instructs tooling to extract browser cookies, which are highly sensitive session credentials. In this context, the capability is presented as a convenience workaround, but it materially raises the risk of credential theft, overcollection of unrelated cookies, and unauthorized account use if followed by an agent or user without strict boundaries.
Content: Scanner excerpt · SKILL.md (reported line 99)May include surrounding context.
L" # download subtitles, then read the .vtt file yt-dlp --dump-json "ytsearch5:query" # search

text
## Bilibili (yt-dlp) ```bash yt-dlp --dump-json "https://www.bilibili.com/video/BVxxx" yt-dlp --write-sub --write-auto-sub --sub-lang "zh-Hans,zh,en" --convert-subs vtt --skip-download -o "/tmp/%(id)s" "URL"

Server IPs may get 412. Use --cookies-from-browser chrome or configure proxy.

Reddit

bash
curl -s "https://www.reddit.com/r/SUBREDDIT/hot.json?limit=10" -H "User-Agent: agent-reach/1.0" curl -s "https://www.reddit.com/search.json?q=QUERY&limit=10" -H "User-Agent: agent-reach/1.0"

Server IPs may get 403. Search via SkillBoss API Hub instead, or configure proxy.

GitHub (gh CLI)

bash
gh search repos "query" --sort stars --limit 10 gh repo view owner/repo gh search code "query" --language python gh issue list -R owner/repo --state open gh issue view 123 -R owner/repo

小红书 / XiaoHongShu (mcp

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The description advertises broad web search, scraping, platform reading, posting, and setup behavior but does not warn that user queries, URLs, or account-linked actions may be sent to third-party services or external platforms. Given this skill's purpose, omission of privacy and data-sharing disclosure materially increases the risk of users unknowingly exposing sensitive data.
Content: No source excerpt is available for this finding.

Session Persistence

Medium

Category: Rogue Agent
Confidence: 60% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · SKILL.md (reported line 36)May include surrounding context.
md
## ⚠️ Workspace Rules **Never create files in the agent workspace.** Use `/tmp/` for temporary output and `~/.agent-reach/` for persistent data. ## Web — Any URL

External Transmission

Medium

Category: Data Exfiltration
Confidence: 94% confidence
Finding: This code sends URLs and associated requests to a third-party API endpoint, which is an external data transmission path. In context, that is expected functionality for a web-scraping skill, but it is still security-relevant because sensitive user-provided URLs or embedded tokens could be disclosed to the external service without adequate notice or filtering.
Content: Scanner excerpt · SKILL.md (reported line 47)May include surrounding context.
md
SKILLBOSS_API_KEY = os.environ["SKILLBOSS_API_KEY"] result = requests.post( "https://api.heybossai.com/v1/pilot", headers={"Authorization": f"Bearer {SKILLBOSS_API_KEY}", "Content-Type": "application/json"}, json={"type": "scraper", "inputs": {"url": "URL"}},

External Transmission

Medium

Category: Data Exfiltration
Confidence: 94% confidence
Finding: This code sends URLs and associated requests to a third-party API endpoint, which is an external data transmission path. In context, that is expected functionality for a web-scraping skill, but it is still security-relevant because sensitive user-provided URLs or embedded tokens could be disclosed to the external service without adequate notice or filtering.
Content: Scanner excerpt · SKILL.md (reported line 47)May include surrounding context.
md
SKILLBOSS_API_KEY = os.environ["SKILLBOSS_API_KEY"] result = requests.post( "https://api.heybossai.com/v1/pilot", headers={"Authorization": f"Bearer {SKILLBOSS_API_KEY}", "Content-Type": "application/json"}, json={"type": "scraper", "inputs": {"url": "URL"}},

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 48)May include surrounding context.
md
SKILLBOSS_API_KEY = os.environ["SKILLBOSS_API_KEY"] result = requests.post( "https://api.heybossai.com/v1/pilot", headers={"Authorization": f"Bearer {SKILLBOSS_API_KEY}", "Content-Type": "application/json"}, json={"type": "scraper", "inputs": {"url": "URL"}}, timeout=60,

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 66)May include surrounding context.
md
SKILLBOSS_API_KEY = os.environ["SKILLBOSS_API_KEY"] result = requests.post( "https://api.heybossai.com/v1/pilot", headers={"Authorization": f"Bearer {SKILLBOSS_API_KEY}", "Content-Type": "application/json"}, json={"type": "scraper", "inputs": {"url": "URL"}}, timeout=60,

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 175)May include surrounding context.
md
SKILLBOSS_API_KEY = os.environ["SKILLBOSS_API_KEY"] result = requests.post( "https://api.heybossai.com/v1/pilot", headers={"Authorization": f"Bearer {SKILLBOSS_API_KEY}", "Content-Type": "application/json"}, json={"type": "scraper", "inputs": {"url": "URL"}}, timeout=60,

External Transmission

Medium

Category: Data Exfiltration
Confidence: 94% confidence
Finding: This search example transmits user queries to a third-party API service. Although this is core functionality rather than overtly malicious behavior, it becomes dangerous when users enter confidential research topics, personal data, or regulated content without being warned that the query leaves the local environment.
Content: Scanner excerpt · SKILL.md (reported line 65)May include surrounding context.
md
SKILLBOSS_API_KEY = os.environ["SKILLBOSS_API_KEY"] result = requests.post( "https://api.heybossai.com/v1/pilot", headers={"Authorization": f"Bearer {SKILLBOSS_API_KEY}", "Content-Type": "application/json"}, json={"type": "search", "inputs": {"query": "query"}, "prefer": "balanced"},

External Transmission

Medium

Category: Data Exfiltration
Confidence: 94% confidence
Finding: This search example transmits user queries to a third-party API service. Although this is core functionality rather than overtly malicious behavior, it becomes dangerous when users enter confidential research topics, personal data, or regulated content without being warned that the query leaves the local environment.
Content: Scanner excerpt · SKILL.md (reported line 65)May include surrounding context.
md
SKILLBOSS_API_KEY = os.environ["SKILLBOSS_API_KEY"] result = requests.post( "https://api.heybossai.com/v1/pilot", headers={"Authorization": f"Bearer {SKILLBOSS_API_KEY}", "Content-Type": "application/json"}, json={"type": "search", "inputs": {"query": "query"}, "prefer": "balanced"},

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The XiaoHongShu example includes a publish_content operation without an explicit warning that it can post to an external account. In this context, the skill is especially risky because it combines broad triggers with account-capable tooling, so accidental invocation could create unwanted public content or reputational harm.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The guidance to import cookies lacks a warning that cookies are sensitive session credentials that can grant account access if mishandled. In an agent skill context, normalizing cookie import without safeguards can lead users to expose authentication material to tools or logs unnecessarily.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 93% confidence
Finding: The LinkedIn fallback scraping example sends a profile URL to a third-party service, creating another external transmission path. This is more sensitive in context because it may involve personal profile data and authenticated browsing-related workflows, so users should be clearly informed before such requests are made.
Content: Scanner excerpt · SKILL.md (reported line 174)May include surrounding context.
md
SKILLBOSS_API_KEY = os.environ["SKILLBOSS_API_KEY"] result = requests.post( "https://api.heybossai.com/v1/pilot", headers={"Authorization": f"Bearer {SKILLBOSS_API_KEY}", "Content-Type": "application/json"}, json={"type": "scraper", "inputs": {"url": "https://linkedin.com/in/username"}},

External Transmission

Medium

Category: Data Exfiltration
Confidence: 93% confidence
Finding: The LinkedIn fallback scraping example sends a profile URL to a third-party service, creating another external transmission path. This is more sensitive in context because it may involve personal profile data and authenticated browsing-related workflows, so users should be clearly informed before such requests are made.
Content: Scanner excerpt · SKILL.md (reported line 174)May include surrounding context.
md
SKILLBOSS_API_KEY = os.environ["SKILLBOSS_API_KEY"] result = requests.post( "https://api.heybossai.com/v1/pilot", headers={"Authorization": f"Bearer {SKILLBOSS_API_KEY}", "Content-Type": "application/json"}, json={"type": "scraper", "inputs": {"url": "https://linkedin.com/in/username"}},

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The statement 'User only provides cookies. Everything else is your job.' encourages collection and operational use of sensitive session material without any warning or limitation. This is especially dangerous in context because cookies may enable account takeover-like actions across external platforms and could be reused for posting or data access.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 80% confidence
Finding: The trigger section hard-codes multiple Chinese phrases alongside English ones, but the document does not state whether language selection is optional or user-driven. This can create an implicit locale/language policy issue because the skill behavior appears to assume support for specific languages without explicit opt-in or preference handling.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.

Overview

A.I.G

T08 · Insecure Dependencies

T03 · Remote Payload Retrieval and Execution

SkillSpector

Vague Triggers

YARA rule 'info_stealer': Information stealer patterns (credential harvesting, browser data theft) [malware]

Reddit

GitHub (gh CLI)

小红书 / XiaoHongShu (mcp

Missing User Warnings

Session Persistence

External Transmission

External Transmission

External Transmission

External Transmission

External Transmission

External Transmission

External Transmission

Missing User Warnings

Missing User Warnings

External Transmission

External Transmission

Missing User Warnings

Natural-Language Policy Violations

Static analysis