网页后台 CDP 自动上传

• Outcome: Review
• Latest audit: Sep 19, 2026 · 12:24 PM UTC
• Version: 1.0.1

Overview

This skill is a real browser-automation helper, but it asks the agent to control logged-in browser sessions and includes under-scoped advice for bypassing site protections.

Install only if you intentionally want an agent to control a browser session for web-console uploads or publishing. Use a temporary browser profile where possible, avoid real daily profiles for protected sites, close the debugging browser after use, and require explicit confirmation before any submit, publish, or account-changing action. Do not use the anti-bot/WAF bypass guidance unless you have clear authorization and an approved automation path from the site owner.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (12)

Tainted flow: 'req' from os.environ.get (line 58, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow

Content

# ---------------- CDP ----------------
def targets():
    req = urllib.request.Request('http://127.0.0.1:%s/json/list' % PORT)
    return json.load(urllib.request.urlopen(req, timeout=10))


def pick():

• Confidence: 90% confidence
• Finding: Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Ssd 4

High

• Confidence: 97% confidence
• Finding: This line directly recommends using a real user profile and browser fingerprint when anti-crawling or WAF measures appear, which is effectively advice for stealth and evasion. In a skill whose purpose is automated interaction with web consoles, that materially increases the risk of unauthorized actions being hidden behind legitimate session artifacts.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 89% confidence
• Finding: The skill enables browser automation that uses environment configuration and localhost network access, but it declares no explicit permission or tool scope boundaries. That creates an authorization gap: an agent may invoke capabilities affecting a logged-in browser session without clear user-facing limits or approval expectations.

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: The trigger phrases are broad enough to match many generic upload, publishing, and form-submission requests, including sensitive admin-console workflows. Without scope boundaries, an agent could select this skill for high-impact actions on third-party sites or accounts where automation should require stricter validation.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The skill promotes using a logged-in browser session for uploads and submissions but does not provide prominent warnings that the agent may act with the user's full authenticated privileges. That omission raises the risk of unintended account changes, data disclosure, or irreversible submissions.

Ssd 4

Medium

• Confidence: 78% confidence
• Finding: The workflow is structured to leverage an existing browser and authenticated context in a way that can be repurposed for stealthy interaction with protected web consoles. In this context, the danger comes less from CDP itself and more from combining silent automation, real-session reuse, and limited guardrails around what sites and actions are permitted.

Context-Inappropriate Capability

Medium

• Confidence: 93% confidence
• Finding: Recommending `--remote-allow-origins=*` weakens origin protections on the DevTools remote debugging interface. If the debugging port is exposed or reachable by other local processes, this broadens who can attach to the browser and control pages, cookies, and authenticated sessions beyond the stated upload automation need.

Context-Inappropriate Capability

Medium

• Confidence: 96% confidence
• Finding: The skill explicitly advises reusing a real user profile and fingerprint to get past anti-bot or WAF protections. That is dangerous because it converts a convenience automation pattern into guidance for evading platform defenses while acting with the user's authenticated identity.

Vague Triggers

Medium

• Confidence: 89% confidence
• Finding: The trigger list is broad enough to activate on many generic browser-automation or upload requests, including sensitive console actions such as publishing and form submission. In this skill’s context, overbroad activation is more dangerous because it targets authenticated browser sessions and administrative web consoles, so accidental invocation could steer high-privilege actions in the user’s real logged-in environment.

Internal Network Request

Medium

• Category: Server-Side Request Forgery

Content

# ---------------- CDP ----------------
def targets():
    req = urllib.request.Request('http://127.0.0.1:%s/json/list' % PORT)
    return json.load(urllib.request.urlopen(req, timeout=10))

• Confidence: 70% confidence
• Finding: Code issues a request to a loopback, link-local, or private-range host. This can reach internal services not meant to be exposed and is a common SSRF pivot.

Natural-Language Policy Violations

Low

• Confidence: 91% confidence
• Finding: The user-facing display name and description are entirely in Chinese, with no indication that the skill supports other languages or is intentionally limited to a Chinese-speaking audience. This can violate language/locale policy when a skill implicitly forces one language without opt-in or justification.

Natural-Language Policy Violations

Low

• Confidence: 96% confidence
• Finding: The file’s user-facing documentation and command descriptions are entirely in Chinese, which imposes a specific language/locale on users without any opt-in or alternative. Under the policy, forcing a language without user choice is a natural-language policy concern.

Static analysis

Detected: suspicious.dynamic_code_execution

Dynamic code execution detected.

Critical

• Code: suspicious.dynamic_code_execution
• Location: scripts/cdp.py:89