Security audit

line-oa-chat-send

Security checks across malware telemetry and agentic risk

Overview

This skill can send authorized LINE OA messages, but it also exposes a persistent browser session through a public remote-access tunnel, so it needs careful review before installation.

Install only if you are comfortable with a public bearer-link browser handoff for LINE OA login and have operational controls for who receives that link, when the tunnel is stopped, and which isolated Chromium profile is used. Prefer a fresh dedicated profile, avoid sharing the handoff URL outside the intended user, and do not use the tunnel path if local-only login is available.

SkillSpector

By NVIDIA

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (4)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 94% confidence
Finding: The skill exercises shell execution and network-facing capabilities but does not declare them, which undermines least-privilege review and makes it easier to approve or run the skill without understanding its real attack surface. In this skill, those capabilities are especially sensitive because they are used to start browser automation, expose temporary remote access, and interact with authenticated sessions.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The declared purpose suggests a narrow action—sending a LINE OA message through an existing authenticated browser—but the skill also provisions runtime dependencies, launches Chromium with a persistent profile, creates displays, and can publish a remote browser handoff URL via Cloudflare Tunnel. That mismatch is dangerous because reviewers or users may authorize a low-risk messaging action without realizing the skill can alter the host environment and create remote access paths to an authenticated session.

Description-Behavior Mismatch

High

Confidence: 98% confidence
Finding: This script intentionally exposes an already authenticated Chromium profile over VNC/noVNC and publishes access through a Cloudflare Quick Tunnel. That grants whoever possesses the emitted URL interactive control of the browser session, which can lead to full account takeover, message sending, reading prior chats, and access to any other sites authenticated in that profile; the bearer-token path is only obscurity and there is no additional authentication layer.

Context-Inappropriate Capability

High

Confidence: 99% confidence
Finding: The Cloudflare Quick Tunnel creates externally reachable remote access to the browser/VNC service, which is far beyond the stated function of this skill. Because the browser is started with an existing persistent profile, compromise of the URL effectively hands an external party the live authenticated session and its cookies, stored state, and account access.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.