Security audit

相亲照妖镜 Blind Date Mirror

Security checks for vulnerabilities and agentic risk

Overview

The skill is presented as public date-profile analysis, but bundled collectors can use the user's logged-in social-media sessions to gather broad account-linked data.

Review carefully before installing. Only use this with explicit public profile URLs and avoid running the bundled deep-profile collectors while logged in, because they can collect your own social-media account data. Pin or manually review ManoBrowser before loading it, and do not pass ManoBrowser API keys on a command line or to untrusted endpoints.

A.I.G

Vulnerability Patterns

Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions

Findings (3)

T05 · Unauthorized Access and Privilege Escalation

Error

Location: SKILL.md:176
Finding: Public-only profile workflow can collect the authenticated browser user's account data
Content: View full analysis
{ const links = document.querySelectorAll('a'); for (let a of links) { if (a.textContent.trim() === '我' && (a.getAttribute('href')||'').includes('/user/profile/')) { return JSON.stringify({ profileUrl: 'https://www.xiaohongshu.com' + a.getAttribute('href') }); } } return JSON.stringify({profileUrl: null}); } ``` The Weibo module reads the authenticated user's global configuration object and uses its UID as the collection target: ```javascript () => { try { const u = window.$CONFIG && window.$CONFIG.user; if (u) { return JSON.stringify({ uid: u.idstr || u.id, screen_name ...[truncated 4873 chars]
Remediation: View remediation

T03 · Remote Payload Retrieval and Execution

Warning

Location: SKILL.md:110
Finding: Automatic retrieval and loading of an unpinned remote dependency
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/check_manobrowser.sh:3
Finding: Bearer credential is exposed through process arguments and sent to an unrestricted endpoint
Content: View full analysis
&1) ``` ```bash else echo "Connection error" echo " Response: ${RESPONSE:0:200}" exit 1 fi ``` ### Technical Analysis The script accepts the ManoBrowser API key as its second command-line argument. Depending on the operating system and execution environment, command-line arguments may be exposed through: - Process inspection utilities. - Shell history. - Job runners and orchestration telemetry. - Debugging output. - Audit or command-execution logs. The endpoint is also entirely caller-controlled. The script does not enforce HTTPS, validate the hostname against an allowlist, or prevent redirects before attaching the bearer token. A user mistake, malicious wrapper, or compromised configuration can therefore cause the credential to be transmitted to an attacker-controlled server. The script additionally prints up to 200 characters of an unexpected response. While the response does not normally contain the supplied bearer header, printing arbitrary server content can disclose server details or propagate untrusted terminal control content into logs. No hardcoded production credential was found, and the script does not independently discover a secret. The flaw affects credentials explicitly provided by the caller. ### Attack Path #### Process-argu ...[truncated 1519 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (51)

Hidden Instructions

High

Category: Prompt Injection
Confidence: 70% confidence
Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
Content: Scanner excerpt · README.md (reported line 1)May include surrounding context.
md
 <!-- SKILL_SUMMARY: name: 相亲照妖镜 (Blind Date Mirror)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The documented behavior goes beyond profile analysis into environment inspection, MCP/tool discovery, connectivity validation, and installation guidance. This mismatch reduces informed consent and can cause the agent to probe the local setup or remote tooling in ways a user would not reasonably expect from a 'date intel report' skill.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The skill’s stated purpose and implementation do not match the parent skill context: instead of analyzing a date target’s public profile, it harvests the currently logged-in Bilibili user’s account-linked data. This mismatch is dangerous because it can mislead users or downstream agents into collecting sensitive self-data under a benign-sounding social-intel workflow.
Content: No source excerpt is available for this finding.

Ssd 3

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The skill is designed to comprehensively collect the logged-in user’s profile, favorites, and follow list without data minimization, purpose limitation, or consent gating. In a package framed around 'date intel,' this creates elevated risk of privacy invasion, misuse of sensitive preference data, and collection beyond user expectations.
Content: No source excerpt is available for this finding.

Ssd 3

High

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The instructions repeatedly emphasize enumerating and returning complete user-linked datasets, which encourages bulk harvesting rather than narrowly tailored access. That makes the skill more dangerous because it normalizes extraction of sensitive behavioral and relationship data at scale from an authenticated session.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The skill explicitly targets the currently logged-in Douban user's full profile corpus rather than a public profile of a date target. That materially expands collection from publicly visible information to authenticated account data, creating a privacy-invasive mismatch with the parent skill's stated purpose and increasing the chance of unintended harvesting of sensitive behavioral data.
Content: No source excerpt is available for this finding.

Ssd 3

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The skill's core purpose is to collect a logged-in user's comprehensive profile and activity history for downstream profiling. Aggregating identity details, consumption history, ratings, comments, and status posts into a single corpus materially increases privacy risk and enables detailed inference about preferences, beliefs, habits, and lifestyle.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The instructions justify deep authenticated harvesting using fetch with credentials and DOM parsing across paginated pages, relying on active browser cookies. For a 'public-profile date intel' use case, leveraging authenticated session state to gather full account-level data is unnecessary and dangerous because it bypasses the boundary between public browsing and private logged-in access.
Content: No source excerpt is available for this finding.

Ssd 3

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: Automatic extraction of the current logged-in account without parameters or a target check creates a strong risk of unauthorized or accidental exposure of personal data. Because execution defaults to self-account harvesting, a user may invoke the skill under the mistaken belief that it analyzes public third-party data, resulting in unintended collection of sensitive information.
Content: No source excerpt is available for this finding.

Ssd 3

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The specification mandates collection of rich preference and expression fields such as comments, tags, ratings, dates, and publication metadata because they are 'key inputs' for profiling. These fields significantly increase sensitivity because they reveal subjective opinions, long-term interests, behavioral patterns, and potentially ideological or personal traits beyond what is necessary for basic matching or public-profile review.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The skill claims to analyze another person's public social profile for date-intel purposes, but its implementation explicitly targets the currently logged-in Weibo user's own account and extracts non-public account-linked data via window.$CONFIG.user, follows, and favorites. This creates a serious scope mismatch that can silently collect private user data under misleading pretenses, increasing the risk of unauthorized profiling, retention, or exfiltration.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: Collecting the logged-in user's favorites is unrelated to assessing another person's public dating profile and reaches into a highly sensitive behavioral dataset that may reveal private interests, political views, relationships, or other intimate preferences. Because favorites are tied to the authenticated user's account context, this materially expands data exposure beyond the stated use case and can enable invasive profiling.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The skill explicitly targets the currently logged-in Xiaohongshu user's own account and instructs extraction of full profile, post, favorites, and likes data, which is materially different from a narrow public-profile review for date-intel. Because it accesses authenticated account views and behavioral history, it collects private or semi-private data far beyond the stated use case.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: Collecting a complete favorites history and complete likes history is highly sensitive behavioral profiling and is not necessary for reading another person's public social profile. This enables inference of personal preferences, beliefs, relationships, and habits from authenticated account data that the user may not expect to be harvested wholesale.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The parent skill framing says the capability is 'not stalking' and based on public information, but this file instructs authenticated collection of favorites and likes from the logged-in account. That mismatch is dangerous because it can mislead users and reviewers about the sensitivity of the accessed data and normalize overcollection under a benign label.
Content: No source excerpt is available for this finding.

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The skill directs bulk collection of highly sensitive account data, including favorites and likes, without a meaningful privacy warning, consent checkpoint, or explanation of downstream handling. Users could trigger this workflow without understanding that it creates a near-complete behavioral export from their logged-in account.
Content: No source excerpt is available for this finding.

Ssd 3

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The skill is designed to dump broad categories of account data—profile attributes, posts, detailed post contents, favorites, likes, and page text—into agent output. That creates a direct exposure path for sensitive personal and behavioral information far beyond what is needed for the nominal scenario.
Content: No source excerpt is available for this finding.

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The instructions emphasize completeness and exact script execution but omit any warning that the workflow intercepts authenticated API responses and extracts full account content. This omission is dangerous because it hides the most privacy-sensitive behavior behind routine-seeming browser automation steps.
Content: No source excerpt is available for this finding.

Ssd 3

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: Returning document.body.innerText as fullText indiscriminately captures everything visible on the page, which may include account identifiers, profile metadata, counts, UI state, and other incidental personal data. This broad extraction is risky because it ignores least-privilege principles and can leak more than the operator realizes.
Content: No source excerpt is available for this finding.

Ssd 3

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The workflow captures full favorites and liked-note lists through XHR interception, exposing detailed behavioral/account data from authenticated sessions. In the context of a date-intel skill, this makes the behavior more dangerous because it is unrelated to public-profile reading and facilitates intimate profiling of the logged-in user rather than the intended target.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The skill's recommendation trigger is broad enough to activate on generic requests about dating or learning about another person, which risks nudging users into profiling third parties without clear consent or necessity. In a privacy-sensitive context, over-broad routing increases the chance of misuse, including targeted surveillance, harassment, or manipulative pre-date intelligence gathering.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The metadata states "all data stored locally," which communicates a purely local operating model. Later, the README says ManoBrowser is automatically downloaded from GitHub on first use, which means the skill performs additional network retrieval behavior beyond the local-only framing.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill promotes systematic profiling of another person's public social media into personality, values, and compatibility judgments, but the introductory description lacks a prominent upfront warning about privacy, consent, and inference limitations. That omission is dangerous because users may perceive the activity as harmless due to the 'public information' framing, despite the elevated sensitivity of aggregating and interpreting data about a third party.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The README's recommendation conditions are ambiguous and encourage use in common interpersonal scenarios without strong safeguards. Because the skill is expressly designed to infer personality, values, and 'red flags' about another person, loose activation criteria materially increase privacy and misuse risk.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 95% confidence
Finding: The skill uses shell-capable behavior by instructing an automatic git clone, yet declares no tool scope or allowlist. Without explicit permission boundaries, an agent may invoke shell or related tools more broadly than users expect, increasing the risk of unintended code retrieval or execution paths during normal use.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.