Security audit

Multilogin X

Security checks across malware telemetry and agentic risk

Overview

The skill is framed as browser-profile management but also documents broader account, credential, cloud-phone, ADB, file, billing, transfer, and 2FA actions that need careful review.

Install only if you intentionally want a broad Multilogin administration skill, not just browser profile launching. Treat it as high-trust: avoid putting passwords in command lines or cross-node messages, confirm destructive actions like delete or transfer manually, and review 2FA, cloud-phone, ADB, object, script, cookie, and billing commands before use.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (8)

Description-Behavior Mismatch

High

Confidence: 92% confidence
Finding: The manifest describes only browser-profile management, while the body exposes materially broader capabilities including cloud-phone control, file/object management, transfer, billing, and 2FA administration. This mismatch can mislead users or higher-level policy systems into granting or invoking the skill under a narrower trust assumption than its real authority warrants.

Context-Inappropriate Capability

High

Confidence: 95% confidence
Finding: 2FA administration capabilities are far more sensitive than the stated purpose of managing browser profiles. In the context of an agent skill, exposing commands to enable, view backup codes, or disable 2FA can directly weaken account security and facilitate account takeover if the skill is invoked improperly or by a compromised agent.

Context-Inappropriate Capability

Medium

Confidence: 87% confidence
Finding: Ownership transfer and billing/account functions exceed the declared profile-management scope and enable account-level changes unrelated to launching profiles. This broadens blast radius and can be abused for unauthorized transfer of assets or disclosure of account/billing information.

Context-Inappropriate Capability

High

Confidence: 96% confidence
Finding: The skill includes local ADB control of cloud phones, enabling shell access, screenshots, UI dumping, text input, and taps on remote Android devices. That is a substantial device-control capability unrelated to the narrow stated browser-profile purpose, and in this context it materially increases the risk of surveillance, credential capture, or unauthorized interaction with mobile apps.

Context-Inappropriate Capability

Medium

Confidence: 84% confidence
Finding: Object and extension management permit creating, downloading, deleting, restoring, converting, and enabling artifacts beyond simple profile lifecycle management. In an agent context, these capabilities can be used to introduce or manipulate executable browser extensions or exfiltrate stored objects without users realizing the skill's breadth.

Missing User Warnings

Medium

Confidence: 97% confidence
Finding: The skill instructs users to pass usernames and passwords directly on the command line, which can expose secrets through shell history, process listings, telemetry, and logs. In a multi-user or monitored environment, this creates an avoidable credential disclosure path.

Missing User Warnings

High

Confidence: 99% confidence
Finding: The delegation example embeds plaintext credentials in a cross-node message payload sent to another agent/session. This exposes secrets to intermediaries, logs, task history, and any compromise of the receiving node, creating a direct credential leakage and reuse risk.

Ssd 3

High

Confidence: 98% confidence
Finding: The skill explicitly instructs the operator to obtain and forward user credentials to another agent/node. In this context, that normalizes secret sharing across trust boundaries and increases the chance of credential theft, replay, or storage in agent transcripts and orchestration logs.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.