Security audit

qianwen-cdp

Security checks across malware telemetry and agentic risk

Overview

This skill openly automates a real logged-in Qianwen browser, but its persistent debug-port setup and broad browser-control powers need careful review before use.

Install only if you intentionally want an agent to control a logged-in Qianwen browser. Prefer a dedicated low-privilege Qianwen profile, avoid registry or shortcut persistence unless you truly need always-on automation, close or remove the debug port when done, review any eval/script use carefully, and expect clicks, typing, screenshots, and scraping to operate with your active session.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (8)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: The skill is presented as browser automation, but the documentation also instructs users to modify Windows shortcuts and registry autorun settings to force-enable a remote debugging port. That expands behavior into persistence and system configuration changes, which can silently expose a logged-in browser profile to local takeover via CDP and exceeds the user’s likely expectation from the description.

Context-Inappropriate Capability

Medium

Confidence: 96% confidence
Finding: The documented shortcut and registry changes create a persistent mechanism to launch the browser with `--remote-debugging-port=9666`. A persistent CDP endpoint attached to a real logged-in profile increases the attack surface substantially because any local process that can reach the port may inspect pages, execute script, extract data, or perform actions as the user.

Context-Inappropriate Capability

Medium

Confidence: 95% confidence
Finding: The `eval` command exposes arbitrary JavaScript execution inside a browser tab backed by a real user profile and login state. In this skill’s context, that enables reading page contents, extracting tokens or sensitive DOM data, triggering privileged actions as the user, and bypassing the narrower browser-automation scope described in the skill metadata.

Missing User Warnings

Medium

Confidence: 89% confidence
Finding: The README explicitly promotes driving a real logged-in Qianwen browser profile for automation, including opening pages, filling forms, clicking, scraping content, and taking screenshots, but it does not provide an explicit warning about privacy, session exposure, or unintended actions on behalf of the user. Reusing a live authenticated profile materially increases the risk of data exfiltration, accidental modification, and abuse of existing session cookies if the tool is misused or invoked in the wrong context.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The instructions tell users to modify shortcuts and autorun registry entries without a prominent warning that these are system-impacting, persistent changes that enable remote debugging on a real user profile. Users may not understand that this weakens local security posture and can persist across reboots and normal launches.

Missing User Warnings

Medium

Confidence: 82% confidence
Finding: The manifest explicitly advertises reusing a real logged-in browser session for automation, which can expose authenticated data and trigger unintended actions under the user's identity. In a browser-automation skill, the lack of any warning, consent boundary, or account-safety guidance makes session misuse and privacy harm more likely.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: The `relaunch` path force-kills `qianwen.exe` with `taskkill /F` without warning, confirmation, or checks for unsaved work. Because this browser reuses the user’s real profile for office automation, abruptly terminating it can disrupt active sessions, cause data loss, and unexpectedly affect unrelated user activity.

Known Vulnerable Dependency: ws==8.18.0 — 2 advisory(ies): CVE-2026-45736 (ws: Uninitialized memory disclosure); CVE-2026-48779 (ws: Memory exhaustion DoS from tiny fragments and data chunks)

High

Category: Supply Chain
Confidence: 98% confidence
Finding: ws==8.18.0

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

Detected: suspicious.dangerous_exec

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: qw.cjs:108