Web-search(Bing-CN)

• Outcome: Review
• Latest audit: Sep 16, 2026 · 3:18 AM UTC
• Version: 1.0.0

Overview

This skill is a small Bing China browser-search helper, but its documented browser configuration disables sandboxing while visiting web pages, which needs review before use.

Review this skill before installing. Use it only if you intentionally want Bing CN Chinese-language search behavior, avoid the noSandbox browser setting unless an administrator has accepted that risk in a contained environment, and do not enter third-party credentials unless you explicitly initiated and trust the login flow.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:17

Finding

Browser Sandbox Disabled in Recommended Configuration

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 17–24
Vulnerability Type: Browser isolation disabled through unsafe configuration
Risk Level: High

Complete Code Snippet:

json

{
  "browser": {
    "headless": true,
    "noSandbox": true
  }
}

Technical Analysis

The documented configuration sets noSandbox to true, disabling browser process sandboxing. Browser sandboxing is a defense-in-depth boundary intended to restrict the filesystem, process, and operating-system access available to compromised browser processes.

This skill is designed to visit search results and other websites, which may contain attacker-controlled HTML, JavaScript, media, or browser-rendered content. If such content exploits a browser vulnerability, disabling the sandbox removes an important containment layer. The setting is not required for the skill's stated search and login-detection functionality.

Exploitation depends on an additional browser or rendering-engine vulnerability; the configuration does not independently provide arbitrary code execution.

Attack Path

1. An attacker publishes a malicious page and causes it to appear in Bing search results or supplies a link that the skill processes.
2. The skill opens the attacker-controlled page using a browser launched with noSandbox: true.
3. Malicious page content triggers a compatible vulnerability in the browser or rendering engine.
4. Because browser sandboxing is disabled, successful exploit code operates without the normal sandbox containment boundary.
5. The exploit may access resources available to the browser process or attempt further compromise of the host environment.

Impact Assessment

A successful browser exploit could obtain the privileges of the process running the browser. Depending on that process's operating-system permissions, the attacker could potentially read or modify accessible files, access browser data, intera ...[truncated 443 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove "noSandbox": true from the recommended configuration and preserve browser sandboxing by default:

   json

   {
     "browser": {
       "headless": true
     }
   }
   

2. If a particular deployment cannot start the browser with sandboxing enabled, treat disabling it as a narrowly scoped compatibility exception rather than the default recommendation.
3. For unavoidable exceptions, run the browser inside a dedicated, unprivileged container or virtual machine with:
   • No host filesystem mounts unless strictly required.
   • A read-only root filesystem where practical.
   • Dropped Linux capabilities and no-new-privileges.
   • Restricted network access.
   • No access to host credentials, browser profiles, or sensitive environment variables.
4. Document the security consequences of disabling the sandbox and require explicit administrator approval.
5. Keep the browser and rendering engine fully patched to reduce exposure to known browser vulnerabilities.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill is designed specifically for Bing CN and Chinese-language search behavior without indicating that this locale restriction is optional or user-configurable. While not directly a code-execution issue, this can mislead users, constrain results to a particular jurisdiction or content ecosystem, and reduce user awareness about data handling and search-result differences tied to locale.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The skill explicitly states it may open the host browser and prompt the user to log in to third-party sites, but the description does not provide a prominent warning about this sensitive behavior. That creates a social-engineering and privacy risk because users may be unexpectedly redirected into a non-sandboxed browser context and enter credentials on external sites without clear prior consent.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.