Fox Agent Reach

• Outcome: Review
• Latest audit: Sep 16, 2026 · 3:29 AM UTC
• Version: 1.0.0

Overview

This skill is mostly a broad web-access guide, but it asks agents to use sensitive cookies, public posting tools, persistent local storage, global installs, and mutable remote setup instructions without enough user-control boundaries.

Install only if you are comfortable with an agent making broad web requests and helping configure authenticated channels. Do not let it access your normal browser profile; use a dedicated profile or scoped cookie file, review any remote setup guide before running commands, avoid global package installs where possible, and require an explicit preview and confirmation before any post, comment, or account interaction.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: SKILL.md:73

Finding

Broad Access to Browser-Stored Authentication Cookies

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 73
Vulnerability Type: Least-privilege violation through browser credential access
Risk Level: High

Code Snippet:

markdown

> Server IPs may get 412. Use `--cookies-from-browser chrome` or configure proxy.

Technical Analysis

The Skill recommends using yt-dlp with --cookies-from-browser chrome when a Bilibili request receives an HTTP 412 response. This option causes the invoked tool to access the local Chrome cookie database rather than relying on a narrowly scoped credential supplied specifically for Bilibili.

A Chrome profile may contain authentication cookies for multiple unrelated services. Although yt-dlp ordinarily filters cookies according to the requested destination, granting a third-party executable access to the browser cookie store expands the accessible trust boundary and exposes sensitive session data to the tool and its dependency chain. The instruction does not require explicit consent, identify a dedicated browser profile, or restrict access to an exported target-domain cookie file.

Attack Path

1. The user asks the agent to retrieve Bilibili content.
2. The request fails with an HTTP 412 response.
3. Following the Skill instructions, the agent invokes yt-dlp with --cookies-from-browser chrome.
4. The tool accesses the Chrome profile and its cookie database.
5. A compromised, malicious, or vulnerable tool or dependency could read or misuse browser session material available through that access.
6. Exposed session cookies could potentially be replayed against affected services until they expire or are revoked.

Impact Assessment

Successful misuse could expose authenticated browser sessions and allow account access within the permissions of the affected user sessions. The potential scope includes the target platform and, depending on the browser profile and tool behavior, authentication material associated wi ...[truncated 191 chars]

Remediation

View remediation

Remediation Suggestions

• Require explicit, informed user approval before accessing any browser profile.
• Use a dedicated browser profile containing only the target platform's account.
• Prefer a narrowly scoped cookie file exported only for the required Bilibili domains.
• Run the media retrieval tool in a sandbox with restricted filesystem and network access.
• Document exactly which files and credentials will be accessed before executing the command.
• Never log, persist, or transmit cookie values in command output or diagnostic reports.
• Provide a credential-free proxy configuration as the preferred fallback.

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:159

Finding

Unpinned Global Installation of a Third-Party npm Package

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 159
Vulnerability Type: Unpinned and globally installed third-party dependency
Risk Level: Medium

Code Snippet:

markdown

- **Twitter fetch failed?** Ensure `undici` is installed: `npm install -g undici`. Configure proxy: `agent-reach configure proxy URL`.

Technical Analysis

The troubleshooting procedure installs undici globally without pinning a reviewed version or verifying package integrity. Consequently, npm resolves whichever package version and transitive dependency graph are current at execution time. The installed content can therefore differ from the content available when the Skill was audited.

npm package installation may execute lifecycle scripts under the privileges of the user running npm. The global installation flag also changes the shared Node.js environment rather than creating an isolated dependency environment for this Skill. A compromised package release, compromised maintainer account, or unexpectedly incompatible future version could execute code or modify shared tooling.

Attack Path

1. A Twitter operation fails because the required Node.js dependency is unavailable.
2. The agent follows the troubleshooting instruction and runs npm install -g undici.
3. npm retrieves the latest matching package and its transitive dependencies from the configured registry.
4. Any applicable package lifecycle scripts execute with the privileges of the invoking account.
5. A compromised dependency could access user-readable files, environment variables, credentials, and network resources.
6. Because installation is global, modified components remain available to other Node.js operations after the Skill invocation.

Impact Assessment

A malicious dependency could execute arbitrary code with the invoking user's privileges. Potential impact includes theft of user-accessible credentials, modification of files, outbound network co ...[truncated 222 chars]

Remediation

View remediation

Remediation Suggestions

• Pin undici to a reviewed exact version rather than resolving the latest release.
• Verify the package with an approved lockfile and registry integrity metadata.
• Install dependencies in an isolated, project-local environment instead of using -g.
• Use a trusted registry and validate the package publisher and provenance.
• Disable lifecycle scripts during installation where compatible with the package's requirements.
• Run dependency installation and subsequent tools in a restricted container or sandbox.
• Add an explicit approval step showing the exact package, version, source, and intended changes.
• Periodically scan the pinned dependency and its transitive dependencies for known vulnerabilities.

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:162

Finding

Channel Setup Delegated to Mutable Remote Instructions

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 162-166
Vulnerability Type: Unpinned remote setup dependency
Risk Level: Medium

Code Snippet:

markdown

## Setting Up a Channel ("帮我配 XXX")

If a channel needs setup (cookies, Docker, etc.), fetch the install guide:
https://raw.githubusercontent.com/Panniantong/agent-reach/main/docs/install.md

User only provides cookies. Everything else is your job.

Technical Analysis

The Skill delegates channel setup to an installation guide retrieved from the mutable main branch of an external GitHub repository. The remote document can change after this Skill has been reviewed, meaning the effective installation procedure is not fully represented by the audited artifact.

The statement that everything other than supplying cookies is the agent's responsibility encourages broad autonomous handling of any commands introduced into the remote guide. While the audited Skill does not directly pipe the retrieved file into a shell, an agent may interpret the fetched content as executable setup instructions. A repository compromise, maintainer account compromise, or unsafe future update could consequently introduce packages or commands that were not part of this audit.

Attack Path

1. The user requests configuration of a platform channel.
2. The agent follows the Skill and retrieves docs/install.md from the repository's current main branch.
3. The remote document contains instructions that differ from those present when the Skill was audited.
4. The agent treats those instructions as authoritative and proceeds with package installation, Docker operations, configuration changes, or other commands.
5. If the remote guide has been maliciously or unsafely modified, the introduced commands execute with the agent's available privileges.
6. Those commands could access credentials, modify the local environment, install untrusted components, or communicate with ...[truncated 536 chars]

Remediation

View remediation

Remediation Suggestions

• Bundle reviewed installation instructions directly in the Skill package.
• If remote retrieval is necessary, reference an immutable commit hash rather than the main branch.
• Verify the downloaded document against a maintained cryptographic checksum or signature.
• Treat remotely retrieved documentation as untrusted data, not automatically authoritative instructions.
• Parse and display proposed setup commands for user review before execution.
• Require explicit approval for package installation, Docker changes, credential access, and persistent configuration changes.
• Apply an allowlist of permitted commands and installation sources.
• Execute setup steps in a sandbox with least-privilege filesystem, credential, and network access.
• Never expose supplied cookies to commands or destinations that are not explicitly required for the selected platform.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• YARA Signatures: Malware Match, Webshell Match, Cryptominer Match
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (5)

YARA rule 'info_stealer': Information stealer patterns (credential harvesting, browser data theft) [malware]

High

• Category: YARA Match
• Confidence: 87% confidence

Finding

The recommendation to use --cookies-from-browser chrome instructs the agent to extract authenticated browser cookies for use with external tooling. Even if intended for convenience, browser-cookie access is highly sensitive because it can expose active session credentials and extend account access beyond the browser, which is especially dangerous in an automated agent context.

Content

Scanner excerpt · SKILL.md (reported line 73)May include surrounding context.

L" # download subtitles, then read the .vtt file yt-dlp --dump-json "ytsearch5:query" # search

text

## Bilibili (yt-dlp)

```bash
yt-dlp --dump-json "https://www.bilibili.com/video/BVxxx"
yt-dlp --write-sub --write-auto-sub --sub-lang "zh-Hans,zh,en" --convert-subs vtt --skip-download -o "/tmp/%(id)s" "URL"

Server IPs may get 412. Use --cookies-from-browser chrome or configure proxy.

Reddit

bash

curl -s "https://www.reddit.com/r/SUBREDDIT/hot.json?limit=10" -H "User-Agent: agent-reach/1.0"
curl -s "https://www.reddit.com/search.json?q=QUERY&limit=10" -H "User-Agent: agent-reach/1.0"

Server IPs may get 403. Search via Exa instead, or configure proxy.

GitHub (gh CLI)

bash

gh search repos "query" --sort stars --limit 10
gh repo view owner/repo
gh search code "query" --language python
gh issue list -R owner/repo --state open
gh issue view 123 -R owner/repo

小红书 / XiaoHongShu (mcporter)

bas

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The skill advertises that it should be used when a user asks to 'post, comment, or interact on supported platforms' but does not provide a clear warning that these actions can create or modify external state. In an agent setting, this can lead to unintended public posting or account actions if the model interprets a general request as authorization to act on third-party services.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The trigger list includes broad everyday phrases like 'research', 'find information', and 'read this link', which can cause the skill to activate in many normal conversations unrelated to this tool. Because the skill enables network access across many external platforms, overbroad invocation increases the chance of unintended web access, external requests, and execution of high-impact commands without sufficiently specific user intent.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 84% confidence

Finding

The skill instructs the agent to store persistent data under ~/.agent-reach/, creating session persistence outside the workspace. In an agent environment, persistent storage can retain cookies, tokens, browsing artifacts, or operational state across tasks, increasing the blast radius of compromise and enabling unintended cross-session data exposure.

Content

Scanner excerpt · SKILL.md (reported line 33)May include surrounding context.

md

## ⚠️ Workspace Rules

**Never create files in the agent workspace.** Use `/tmp/` for temporary output and `~/.agent-reach/` for persistent data.

## Web — Any URL

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The included xiaohongshu.publish_content(...) command is a direct content-publishing capability, yet the skill does not surround it with strong safety language or a mandatory approval step. Since it can publish user-visible content to an authenticated external platform, accidental or prompt-induced invocation could cause unauthorized posts, reputational damage, or abuse of the user's account.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.