T09 · Insecure Skill Coding Practices
Error
- Location
scripts/monitor.sh:10- Finding
Untargeted browser screenshot may disclose unrelated sensitive content
- Content
View full analysis
&1) if echo "$PAGE_STATE" | grep -q "_/\|chat\|message"; then echo "Logged in! Sending test message..." else echo "Not logged in - capturing QR..." # Capture QR browser action=screenshot path="$OUTPUT_FILE" # Send QR to user if [ -f "$OUTPUT_FILE" ]; then message action=send to="$USER_PHONE" media="$OUTPUT_FILE" echo "QR code sent to $USER_PHONE" else echo "Failed to capture QR" fi fi ``` `scripts/capture_qrcode.sh:7-14`: ```bash echo "Capturing QR code from filehelper.weixin.qq.com..." # Take screenshot browser action=screenshot path="$OUTPUT_FILE" if [ -f "$OUTPUT_FILE" ]; then echo "QR code captured: $OUTPUT_FILE" ls -la "$OUTPUT_FILE" ``` ### Technical Analysis The code queries tabs using the expected WeChat URL but does not extract, validate, or retain the `targetId` of the matching tab. The subsequent `browser action=screenshot` command is invoked without a `targetId` or an element selector. Consequently, the screenshot can be taken from the active or default browser context rather than the WeChat File Helper tab. In `monitor.sh`, the resulting image is then sent through a configured messaging channel. The script also does not verify the final page origin or confirm that the captured image contains a WeChat QR element before transmission. This behavior exceeds the minimum browser access necessary for the declared functionality. The Skill only needs to capture the QR element on a validated WeChat page, not the entire active browser context. ### Attack Path 1. The user or a scheduled job invokes `scripts/monitor.sh`. 2. A browser page other than ...[truncated 1073 chars]- Remediation
View remediation