我的测试

• Outcome: Review
• Latest audit: Sep 11, 2026 · 8:46 PM UTC
• Version: 1.0.0

Overview

The skill’s login-session purpose is clear, but it directs users to keep account credentials and a reusable authenticated session file in the project root without adequate protection guidance.

Review this skill before installing. Use it only in a protected workspace, keep login_credentials.json and auth.json out of source control and backups, restrict their file permissions, treat auth.json like an active login credential, and revoke or rotate the account/session if either file may have been exposed. Prefer pinned Playwright versions in an isolated environment.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:30
• Finding: Unpinned Playwright and Chromium Installation## Vulnerability Details **File Location**: `SKILL.md`, lines 30-35 **Vulnerability Type**: Unpinned third-party dependency installation **Risk Level**: Medium **Evidence**: ```text - 环境中必须已安装 Playwright 和 Chromium - 安装命令： `python3 -m pip install playwright` `python3 -m playwright install chromium` ``` ### Technical Analysis The documented installation procedure retrieves the latest available Playwright package and its associated Chromium binary without pinning an audited version or verifying cryptographic hashes. The project provides no dependency lockfile, integrity manifest, or approved artifact source. Python package installation can execute package-controlled installation logic, while the Playwright command downloads and installs an additional executable browser component. Consequently, the effective installed code may change after this Skill has been reviewed. ### Attack Path 1. An attacker compromises the relevant package or artifact distribution channel, or a future release becomes malicious. 2. A user follows the documented commands without specifying an audited version or validating artifact hashes. 3. The mutable package and browser artifacts are downloaded. 4. Package-controlled code executes during installation or subsequent Skill use. 5. The malicious component acts with the permissions of the user running the installation or browser process. ### Impact Assessment Successful supply-chain exploitation could permit arbitrary code execution under the invoking user's account. This may expose local files, browser data, outbound-system credentials, and reusable authentication state accessible to that account. No evidence indicates automatic privilege escalation beyond the invoking user's existing permissions.
• Remediation: ## Remediation Suggestions - Pin Playwright to a reviewed, exact version rather than installing the latest release. - Maintain a dependency lockfile and require cryptographic hashes for Python packages. - Document an approved package index and trusted source for browser binaries. - Verify downloaded artifacts against publisher-provided checksums or signatures. - Install dependencies inside an isolated virtual environment or container with minimal privileges. - Establish a controlled update process that reviews and tests new dependency versions before deployment.

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:13
• Finding: Credentials and Reusable Authentication State Stored in the Project Root## Vulnerability Details **File Location**: `SKILL.md`, lines 13-27 **Vulnerability Type**: Plaintext sensitive-data storage **Risk Level**: High **Evidence**: ```text 1. 在项目根目录准备凭证文件 `login_credentials.json` 2. 文件格式参考 `login_credentials.example.json` 3. 运行： `python3 save_session.py` 4. 脚本会自动打开登录页并填写账号密码 5. 在浏览器中手动完成验证码并点击登录 6. 登录成功后，脚本会自动保存 `auth.json` ## 输出 - `auth.json` ## 依赖文件 - `save_session.py` - `login_credentials.json` ``` ### Technical Analysis The Skill directs users to create `login_credentials.json` in the project root and produces `auth.json` containing reusable browser authentication state. The supplied project contains no `.gitignore`, permission-hardening instructions, secret-store integration, encryption requirements, retention policy, or secure deletion procedure for these files. A browser storage-state file commonly contains authentication cookies or origin storage that can act as a bearer credential. The accompanying session contract explicitly requires nonempty cookies and validates that the state can enter the business workbench. Possession of a still-valid `auth.json` may therefore bypass the password and manual CAPTCHA step. The referenced `save_session.py` is absent, so its exact file permissions and handling behavior cannot be verified. The finding is limited to the insecure storage workflow explicitly prescribed by the documentation. ### Attack Path 1. A user places account credentials in `login_credentials.json` at the project root. 2. The user runs the documented login workflow, which creates `auth.json`. 3. The files remain in a broadly accessible project directory without documented restrictive permissions or repository exclusions. 4. Another local process or user, a backup system, an archive operation, or an accidental source-control commit obtains one or both files. 5. The attacker uses the disclosed account credentials or imports the valid browser state into a ...[truncated 615 chars]
• Remediation: ## Remediation Suggestions - Do not store account passwords in the project tree. Retrieve them at runtime from an operating-system credential manager, managed secret service, or protected environment injection mechanism. - Store browser session state outside the repository in a dedicated runtime directory. - Create sensitive files with owner-only permissions, such as mode `0600` on supported systems, and ensure parent directories are not accessible to unrelated users. - Add `login_credentials.json`, `auth.json`, session metadata, and runtime session directories to `.gitignore` and equivalent packaging and backup exclusion rules. - Avoid logging credentials, cookies, authorization headers, or complete storage-state objects. - Minimize session lifetime and privileges, rotate exposed credentials, and revoke sessions after use or suspected disclosure. - Define a retention period and securely remove expired credential and session files. - Document that `auth.json` must be treated as a secret equivalent to an active credential. - Add implementation-level checks in `save_session.py` to reject unsafe output locations and enforce restrictive file permissions.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (3)

Credential Access

High

• Category: Privilege Escalation

Content

## 执行方式

1. 在项目根目录准备凭证文件 `login_credentials.json`
2. 文件格式参考 `login_credentials.example.json`
3. 运行：
   `python3 save_session.py`

• Confidence: 70% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

## 执行方式

1. 在项目根目录准备凭证文件 `login_credentials.json`
2. 文件格式参考 `login_credentials.example.json`
3. 运行：
   `python3 save_session.py`

• Confidence: 70% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The skill explicitly instructs users to place login credentials in a local JSON file and to save a reusable authenticated browser session to auth.json, but it provides no guidance on protecting, scoping, deleting, or excluding these sensitive artifacts. This creates a real risk of credential and session-token exposure through accidental commits, local disclosure, or reuse by unintended parties.

Static analysis

No suspicious patterns detected.