Multilogin X

• Outcome: Review
• Latest audit: Sep 10, 2026 · 9:13 PM UTC
• Version: 1.0.1

Overview

This Multilogin helper is mostly coherent, but it needs review because it installs mutable native binaries and exposes account credentials through command lines and remote-node messages.

Install only if you trust the Multilogin binary source and are comfortable reviewing commands before execution. Prefer pinned, verified downloads; avoid pasting passwords or proxy secrets into command lines or delegated node messages; and require explicit confirmation before cloud-phone billing, ADB access, deletes, transfers, 2FA changes, or remote-node delegation.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:25
• Finding: Unverified Mutable Binaries Are Downloaded and Executed<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 25-31, 46-59, 74-89, and 98-110 **Vulnerability Type**: Remote payload retrieval and execution without integrity verification **Risk Level**: High ### Vulnerable Code ```bash # Resolve latest versions CLI_VER=$(curl -sL "https://ml000x-dev-dists.s3.eu-north-1.amazonaws.com/cli-mlx/latest") LAUNCHER_VER=$(curl -sL "https://ml000x-dev-dists.s3.eu-north-1.amazonaws.com/launcher-mlx/latest") echo "Installing xcli $CLI_VER, launcher $LAUNCHER_VER" # Download binaries curl -L -o /usr/local/bin/xcli "https://ml000x-dev-dists.s3.eu-north-1.amazonaws.com/cli-mlx/${CLI_VER}/xcli_linux_amd64" curl -L -o /usr/local/bin/mlx-launcher "https://ml000x-dev-dists.s3.eu-north-1.amazonaws.com/launcher-mlx/${LAUNCHER_VER}/launcher-linux_amd64.bin" # Make executable chmod +x /usr/local/bin/xcli /usr/local/bin/mlx-launcher # Verify xcli --help mlx-launcher --help ``` The macOS instructions additionally disable a platform security control: ```bash # macOS may quarantine downloaded binaries — remove the flag xattr -d com.apple.quarantine /usr/local/bin/xcli 2>/dev/null xattr -d com.apple.quarantine /usr/local/bin/mlx-launcher 2>/dev/null ``` Equivalent unverified downloads are also provided for Windows: ```powershell $CLI_VER = (Invoke-WebRequest -Uri "https://ml000x-dev-dists.s3.eu-north-1.amazonaws.com/cli-mlx/latest").Content.Trim() $LAUNCHER_VER = (Invoke-WebRequest -Uri "https://ml000x-dev-dists.s3.eu-north-1.amazonaws.com/launcher-mlx/latest").Content.Trim() Invoke-WebRequest -Uri "https://ml000x-dev-dists.s3.eu-north-1.amazonaws.com/cli-mlx/${CLI_VER}/xcli_windows_amd64.exe" -OutFile "$env:USERPROFILE\xcli.exe" Invoke-WebRequest -Uri "https://ml000x-dev-dists.s3.eu-north-1.amazonaws.com/launcher-mlx/${LAUNCHER_VER}/launcher-windows_amd64.exe" -OutFile "$env:USERPROFILE\mlx-launcher.exe" ``` ### Technical Analysis The installation procedure retrieves native executables based on mutable `latest` end ...[truncated 2093 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Pin exact reviewed versions instead of resolving versions through mutable `latest` endpoints. 2. Publish and pin SHA-256 or stronger cryptographic hashes for every supported platform binary. 3. Verify hashes before applying executable permission or invoking a downloaded file, and fail closed on any mismatch. 4. Prefer vendor-signed packages and verify platform-native signatures, such as Apple code signing and notarization or Authenticode on Windows. 5. Do not automatically remove the macOS quarantine attribute. Direct users through normal Gatekeeper verification and document how to validate the publisher. 6. Prefer an authenticated package repository or official package manager with signed metadata and reproducible version selection. 7. Install to a user-controlled directory unless system-wide installation is explicitly required. Avoid administrative execution where possible. 8. Separate downloading from execution and require explicit user approval after displaying the pinned version, source, checksum, and verified signer. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:147
• Finding: Account and Proxy Credentials Are Exposed Through Command Arguments and Cross-Node Messages<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 147-149, 185, 234-247, and 297-311 **Vulnerability Type**: Plaintext sensitive-data exposure **Risk Level**: Medium ### Vulnerable Code The Skill instructs the agent to place the account password directly in command-line arguments: ```bash xcli login --username 'USER@EMAIL' --password 'PASSWORD' ``` It also explicitly instructs the agent to request credentials: ```text Ask the user for credentials if not provided. Tokens last ~24h, stored in ~/.config/xcli/. ``` The remote-node delegation example embeds credentials directly in an inter-agent task message: ```json { "tool": "sessions_spawn", "agentId": "node-mac", "message": "Start the Multilogin launcher and launch 2 quick profiles with GUI. Use: mlx-launcher -port 45000 & sleep 5 && xcli login --username 'USER' --password 'PASS' && xcli profile-quick --browser-type mimic --os-type macos --automation puppeteer && xcli profile-quick --browser-type stealthfox --os-type macos --automation puppeteer" } ``` Proxy credentials are likewise embedded in command arguments and URLs: ```bash xcli mobile-profiles-create \ --mobile-type "Android 14" \ --profile-name "my-phone" \ --proxy "socks5://user:pass@host:1080" ``` ### Technical Analysis Passing secrets as command-line arguments may expose them through process inspection interfaces, shell history, terminal capture, command auditing, agent traces, telemetry, debugging output, and error reports. The `sessions_spawn` example broadens the exposure further by serializing the username and password into an inter-agent message. That message may be stored in the originating agent's transcript, gateway logs, remote-node task history, observability systems, or failure reports. Forwarding a reusable account password to another node exceeds the minimum privilege necessary when that node could instead maintain its own authenticated session or receive a short-lived, narrowly scoped authori ...[truncated 1644 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Do not place passwords, proxy credentials, tokens, or transient ADB credentials in command-line arguments or inter-agent messages. 2. Use an interactive masked prompt, standard input, an OS credential manager, or a vendor-supported secure login flow. 3. Authenticate independently on each destination node. The Mac node should keep its own protected authenticated session rather than receive the user's reusable password from another agent. 4. If delegation requires authorization, use a short-lived, narrowly scoped token that cannot perform unrelated account operations. 5. Configure the agent, gateway, shell, and task runner to redact secrets from transcripts, telemetry, exception output, and audit logs. 6. Disable shell history around unavoidable sensitive operations and ensure process arguments cannot be read by unrelated users; these are defense-in-depth measures, not substitutes for a secure authentication interface. 7. Store tokens with restrictive file permissions and document their location, lifetime, revocation procedure, and cleanup behavior. 8. Represent proxy credentials through a protected credential reference or secret store rather than embedding them in a proxy URL. 9. Require explicit user confirmation before transmitting any credential to another host or node, and identify the destination and purpose before transmission. ]]>

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (10)

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: The manifest advertises a narrow capability set around browser profile management, but the body exposes much broader and more sensitive functions including remote mobile device control, object/file operations, workspace administration, and 2FA/billing actions. This scope mismatch can mislead users and policy systems into granting or invoking the skill in contexts where they would not expect these higher-risk capabilities.

Missing User Warnings

High

• Confidence: 99% confidence
• Finding: The delegation example embeds plaintext credentials inside a message sent to another agent/session, which risks exposure in message logs, broker infrastructure, agent transcripts, or node-side debugging output. Because the secret is transmitted across a separate trust boundary, compromise of either side can leak reusable account credentials.

Ssd 3

High

• Confidence: 99% confidence
• Finding: Passing user credentials in plain text to another agent/node is a direct secret-handling flaw because it distributes the secret to additional systems and logs outside the user's immediate control. This materially increases the attack surface and can enable account takeover if the remote node, transport, or session history is compromised.

Whitespace Padding

Medium

• Category: Prompt Injection

Content

---                                                                                                            
name: multilogin                                                                                               
description: Use when you need to manage Multilogin X browser profiles — launch quick disposable profiles,     
list/start/stop saved profiles, or check launcher status using the xcli CLI tool.

• Confidence: 70% confidence
• Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Whitespace Padding

Medium

• Category: Prompt Injection

Content

---                                                                                                            
name: multilogin                                                                                               
description: Use when you need to manage Multilogin X browser profiles — launch quick disposable profiles,     
list/start/stop saved profiles, or check launcher status using the xcli CLI tool.

• Confidence: 70% confidence
• Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Whitespace Padding

Medium

• Category: Prompt Injection

Content

---                                                                                                            
name: multilogin                                                                                               
description: Use when you need to manage Multilogin X browser profiles — launch quick disposable profiles,     
list/start/stop saved profiles, or check launcher status using the xcli CLI tool.                              
metadata: { "openclaw": { "emoji": "🌐", "requires": { "bins": ["xcli", "mlx-launcher"] } } }

• Confidence: 70% confidence
• Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Whitespace Padding

Medium

• Category: Prompt Injection

Content

list/start/stop saved profiles, or check launcher status using the xcli CLI tool.                              
metadata: { "openclaw": { "emoji": "🌐", "requires": { "bins": ["xcli", "mlx-launcher"] } } }                   
---                                                                                                            
                                                                                                               
# Multilogin X

Manage anti-detect browser profiles via the `xcli` CLI.

• Confidence: 70% confidence
• Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

```bash
# Resolve latest versions
CLI_VER=$(curl -sL "https://ml000x-dev-dists.s3.eu-north-1.amazonaws.com/cli-mlx/latest")
LAUNCHER_VER=$(curl -sL "https://ml000x-dev-dists.s3.eu-north-1.amazonaws.com/launcher-mlx/latest")
echo "Installing xcli $CLI_VER, launcher $LAUNCHER_VER"

• Confidence: 60% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Missing User Warnings

Medium

• Confidence: 98% confidence
• Finding: The instructions place account credentials directly on the command line, which commonly exposes them to shell history, process listings, logs, and telemetry. In a multi-user or monitored environment, this can lead to credential disclosure and account compromise.

Context-Inappropriate Capability

Medium

• Confidence: 94% confidence
• Finding: The skill includes remote task delegation to another node via sessions_spawn, expanding execution beyond the local environment described in the manifest. That creates a trust-boundary crossing where commands and sensitive data may be executed or exposed on a separate agent, increasing the chance of unintended remote actions or data leakage.

Static analysis

No suspicious patterns detected.