Security audit

千问浏览器原生 CDP 驱动

Security checks for vulnerabilities and agentic risk

Overview

This skill is openly for Qianwen browser automation, but it uses a real logged-in browser profile and can leave a persistent local debugging interface enabled.

Install only if you intentionally want automation against an authenticated Qianwen profile. Prefer a dedicated automation profile, avoid applying the shortcut patch unless you understand that it can leave CDP enabled across browser launches, and require explicit user confirmation before running eval, launch, relaunch, posting, form submission, deletion, or other account-impacting actions.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (3)

T09 · Insecure Skill Coding Practices

Error

Location: patch_lnk.py:18
Finding: Persistent Unauthenticated CDP Access to the User's Authenticated Browser Profile
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: qw.cjs:195
Finding: Unrestricted Caller-Controlled JavaScript Execution in Authenticated Browser Pages
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Note

Location: qw.cjs:30
Finding: Environment-Controlled Module Loading and Executable Launch
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (10)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: The skill’s stated purpose is browser automation, but the documentation also describes persistent modification of local Windows shortcut files to inject a remote debugging port into multiple launch paths. That materially expands behavior into host persistence and local file tampering, which is security-sensitive and not clearly disclosed as part of the core capability. In this context, it is especially risky because it enables long-lived CDP access to a real logged-in browser profile, increasing the chance of unauthorized account actions or data exposure.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The invocation description is broad enough to match many ordinary browser tasks, which can cause the skill to be selected in situations where a less-privileged or safer tool would suffice. Because this skill operates a real logged-in browser via CDP, overbroad triggering increases the likelihood of unnecessary access to sensitive sessions and unintended external actions.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The documentation emphasizes using the user’s real logged-in profile for automation and content access, but it does not present a prominent upfront warning about privacy, session reuse, and account-impact risks. That omission is dangerous because users may not understand that the automation can read authenticated content, perform actions as them, and expose sensitive data from an existing profile.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The skill text repeatedly assumes operation against 'the boss' real logged-in profile and frames that as the default, rather than presenting a neutral, consent-based choice. This normalizes acting through another person’s authenticated session and can encourage automation that exceeds the actual operator’s authority, especially when combined with instructions to preserve login state and avoid disrupting the existing instance.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The skill is presented as browser automation, but its launch flow can terminate all running qianwen.exe processes and relaunch the browser against the user's real profile. That creates side effects beyond tab automation: it can disrupt active user sessions, risk profile corruption, and manipulate a privileged authenticated browser context without clear scoping or consent.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The eval command exposes arbitrary JavaScript execution inside any browser target created or attached by the tool. In the context of a real logged-in browser profile, this enables unrestricted reading/modification of page data, DOM scraping, triggering privileged actions on sites, and access to sensitive in-session content well beyond the advertised 'open/click/fill/screenshot' scope.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The inline comment describes a graceful close intended for a relaunch flow, implying the browser will be brought back up afterward. In reality, after taskkill, the code calls ensureInstance(), whose documented behavior is to refuse spawning and merely report that launch is needed if CDP is not already listening.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The relaunch path silently kills all running qianwen.exe processes without an in-band warning or confirmation. In a skill intended for ordinary browser automation, that can unexpectedly destroy user work, interrupt authenticated sessions, and facilitate covert takeover of the browser context under automation control.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Low

Category: Not specified by scanner
Confidence: 77% confidence
Finding: The skill's purpose is to drive Qianwen Browser via CDP, but the implementation inspects host environment variables (QW_WS_PATH, QW_EXE, QW_PROFILE, QW_CDP_PORT) and probes specific local directories for dependencies. While partly practical, this host-environment discovery is not expressed in the manifest and is not directly part of the user-facing browser automation purpose.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 82% confidence
Finding: This function captures page content and persists it to a filesystem path, which affects user data/storage and may save sensitive page contents locally. The operation lacks a confirmation prompt or explicit runtime warning beyond the command name and inline code comments.
Content: No source excerpt is available for this finding.