Agent Reach

• Outcome: Review
• Latest audit: Sep 11, 2026 · 6:50 AM UTC
• Version: 0.1.0

Overview

This skill fits its web-automation purpose, but it gives agents broad account, cookie, setup, and anti-bot instructions without enough user-control safeguards.

Install only if you are comfortable giving an agent broad web and social-platform automation authority. Use secondary accounts and dedicated browser profiles, do not paste or store primary-account cookies casually, review setup commands before they run, require explicit confirmation before any posting/commenting, and avoid anti-bot bypass paths unless you accept the platform and account risks.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:159

Finding

Unpinned Global npm Package Installation

Content

View full analysis

Remediation

View remediation

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: SKILL.md:68

Finding

Overbroad Browser Cookie Access and Unsafe Authentication Cookie Handling

Content

View full analysis

Server IPs may get 412. Use `--cookies-from-browser chrome` or configure proxy. ``` ```markdown > Requires login. Use Cookie-Editor to import cookies. ``` ```markdown User only provides cookies. Everything else is your job. ``` ### Technical Analysis The Skill recommends loading cookies directly from Chrome and manually transferring cookies through Cookie-Editor. Browser cookie stores can contain reusable authenticated-session tokens and other sensitive data. The instructions do not require a dedicated browser profile, restrict access to a particular domain, define secure storage permissions, prohibit logging, or specify deletion after use. The `--cookies-from-browser chrome` option can provide the invoked tool with access to cookies from a general browser profile. Although the selected tool may normally filter cookies according to the requested URL, the Skill does not establish or verify that boundary. Likewise, asking a user to provide exported cookies can result in session credentials being exposed through chat transcripts, command histories, temporary files, logs, or third-party integrations. Cookie use is relevant to accessing authenticated platform content, so it is not inherently unauthorized. The security concern is the lack of least-privilege controls and credential-handling safeguards. ### Attack Path 1. Anonymous platform access fails, or a platform requires authentication. 2. The Agent follows the Skill and either reads cookies from the user's ordinary Chrome profile or asks the user to export cookies. 3. Authentication cookies become accessible to a CLI, MCP integration, local process, conversation transcript, or temporary storage location. 4. A compromised tool, overly broad integration, local attacker, or ...[truncated 1047 chars]

Remediation

View remediation

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:164

Finding

Mutable Remote Setup Instructions Used as an Installation Authority

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• YARA Signatures: Malware Match, Webshell Match, Cryptominer Match

Findings (6)

YARA rule 'info_stealer': Information stealer patterns (credential harvesting, browser data theft) [malware]

High

• Category: YARA Match
• Confidence: 90% confidence

Finding

Recommending --cookies-from-browser chrome instructs the agent to extract authenticated browser cookies directly from a local browser profile. Even if framed as a workaround for access issues, this touches credential material associated with user sessions and can enable unauthorized access or leakage if mishandled.

Content

Scanner excerpt · SKILL.md (reported line 68)May include surrounding context.

L" # download subtitles, then read the .vtt file yt-dlp --dump-json "ytsearch5:query" # search

text

## Bilibili (yt-dlp)

```bash
yt-dlp --dump-json "https://www.bilibili.com/video/BVxxx"
yt-dlp --write-sub --write-auto-sub --sub-lang "zh-Hans,zh,en" --convert-subs vtt --skip-download -o "/tmp/%(id)s" "URL"

Server IPs may get 412. Use --cookies-from-browser chrome or configure proxy.

Reddit

bash

curl -s "https://www.reddit.com/r/SUBREDDIT/hot.json?limit=10" -H "User-Agent: agent-reach/1.0"
curl -s "https://www.reddit.com/search.json?q=QUERY&limit=10" -H "User-Agent: agent-reach/1.0"

Server IPs may get 403. Search via Exa instead, or configure proxy.

GitHub (gh CLI)

bash

gh search repos "query" --sort stars --limit 10
gh repo view owner/repo
gh search code "query" --language python
gh issue list -R owner/repo --state open
gh issue view 123 -R owner/repo

小红书 / XiaoHongShu (mcporter)

bas

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The description advertises posting, commenting, and interacting on external platforms without an explicit warning that these actions can modify third-party accounts or publish public content. That creates a safety gap where users may invoke the skill expecting research behavior but instead enable account-impacting operations.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The trigger list contains very broad, everyday phrases like 'search online', 'research', and '帮我查', making accidental invocation likely. In a skill that can browse, configure channels, and interact with external platforms, over-broad activation increases the chance of unintended network access or account-affecting actions.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 83% confidence

Finding

The skill directs persistent data storage to ~/.agent-reach/, creating a durable local state area. Persistent storage is not inherently malicious, but in a skill that handles cookies, proxies, and platform setup, it increases the risk that tokens, browsing artifacts, or configuration secrets remain on disk beyond the current task.

Content

Scanner excerpt · SKILL.md (reported line 28)May include surrounding context.

md

## ⚠️ Workspace Rules

**Never create files in the agent workspace.** Use `/tmp/` for temporary output and `~/.agent-reach/` for persistent data.

## Web — Any URL

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The setup guidance tells users to import cookies for authenticated access but does not warn that cookies are sensitive credentials equivalent to session tokens. This can lead users or downstream agents to mishandle authentication material, risking account takeover or unauthorized reuse.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill explicitly instructs use of Camoufox to bypass WeChat anti-bot protections for reading articles. That goes beyond ordinary browsing guidance and normalizes anti-detection circumvention, which can violate platform controls and encourage agents to access content through evasive means.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.