Security audit

Dating 约会助手

Security checks for vulnerabilities and agentic risk

Overview

The skill is framed as public dating research, but its bundled collectors can access logged-in account data and persist raw profiles locally, so it needs careful review before installation.

Install only if you are comfortable granting browser-automation access and local raw-data storage. Before use, remove or disable the self-account collectors, require explicit target-profile IDs, avoid likes/favorites/following/private tabs, pin ManoBrowser to a reviewed version, validate any MCP endpoint before sending an API key, and store only minimal summaries with deletion controls.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Tool Hijacking and SpoofingModifies or replaces tools so legitimate-looking calls execute attacker logic
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection

Findings (6)

T01 · Skill Instruction Hijacking

Error

Location: SKILL.md:17
Finding: Mandatory Agent Output Manipulation and Unrelated Promotion
Content: View full analysis
Remediation: View remediation

T03 · Remote Payload Retrieval and Execution

Error

Location: SKILL.md:90
Finding: Automatic Retrieval and Loading of an Unpinned Remote Skill
Content: View full analysis
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

Location: douyin-deep-profile-collect/SKILL.md:42
Finding: Authenticated Self-Account Collection Exceeds the Declared Public-Target Scope
Content: View full analysis
{ try { const resp = await fetch( 'https://api.bilibili.com/x/web-interface/nav', {credentials: 'include'} ); const data = await resp.json(); if (data.code === 0 && data.data) { const d = data.data; return JSON.stringify({ mid: d.mid, uname: d.uname, face: d.face, level: d.level_info?.current_level, coins: d.money, moral: d.moral, vipType: d.vipType, vipStatus: d.vipStatus, isLogin: d.isLogin }); } return JSON.stringify({error: 'not logged in', code: data.code}); } catch(e) { return JSON.stringify({error: e.message}); } } ``` Weibo extracts the authenticated user's global account object: ```javascript () => { try { const u = window.$CONFIG && window.$CONFIG.user; if (u) { return JSON.stringify({ uid: u.idstr || u.id, screen_name: u.screen_name, description: u.description, followers_count: u.followers_count, friends_count: u.friends_count, statuses_count: u.statuses_count, favourites_count ...[truncated 3515 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: SKILL.md:179
Finding: Unsanitized Nickname-Based Paths and Mandatory Raw Profile Persistence
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/check_manobrowser.sh:7
Finding: Bearer API Key Can Be Sent to an Arbitrary Caller-Supplied Endpoint
Content: View full analysis
&1) ``` ### Technical Analysis Both the endpoint and API key are accepted as positional command-line arguments. The endpoint is passed directly to `curl`, and the API key is attached as a bearer credential. The script does not enforce: - HTTPS. - A trusted hostname. - A permitted URL path. - Certificate pinning. - Rejection of localhost, link-local, or private-network destinations. - Redirect restrictions. An attacker who can influence the endpoint argument or associated configuration can cause the valid API key to be sent to an attacker-controlled server. Supplying secrets on the command line can also expose them through shell history, process listings, job logs, or command telemetry. The endpoint is printed to standard output, which may disclose device identifiers embedded in the URL. ### Attack Path 1. A user or Agent obtains a valid ManoBrowser API key. 2. An attacker influences the endpoint argument, setup instructions, or configuration source. 3. The check script is invoked with the attacker's URL and the valid key. 4. `curl` sends `Authorization: Bearer ` to the supplied server. 5. The attacker records the credential. 6. The attacker attempts to reuse the key against the legitimate ManoBrowser service or associated browser-control API. A secondary server-side request forgery path may exist if an attacker can choose interna ...[truncated 587 chars]
Remediation: View remediation

T07 · Tool Hijacking and Spoofing

Warning

Location: xiaohongshu-deep-profile-collect/SKILL.md:271
Finding: Authenticated Page-Wide XMLHttpRequest Hooks Are Not Restored
Content: View full analysis
{ window.__xhs_collected = []; window.__xhs_done = false; window.__xhs_api_count = 0; const origOpen = XMLHttpRequest.prototype.open; const origSend = XMLHttpRequest.prototype.send; XMLHttpRequest.prototype.open = function(method, url, ...rest) { this.__xhs_url = url; return origOpen.call(this, method, url, ...rest); }; XMLHttpRequest.prototype.send = function(...args) { if (this.__xhs_url && (this.__xhs_url.includes('note/collect/page') || this.__xhs_url.includes('note/like/page'))) { this.addEventListener('load', function() { try { const data = JSON.parse(this.responseText); if (data.data && data.data.notes) { window.__xhs_api_count++; data.data.notes.forEach(note => { window.__xhs_collected.push({ note_id: note.note_id, display_title: note.display_title || '', type: note.type, user: note.user ? { nickname: note.user.nickname, user_id: note.user.user_id } : null, interact_info: note.interact_info ? { liked_count: note.interact_info.liked_count } : null }); }); if (!data.data.has_more) { window.__xhs_done = true; } } } catch (e) {} }); } return origSend.apply(this, args); }; return JSON.stringify({injected: true}); } ``` ### Technical Analysis The collector replaces the page-wide `XMLHttpRequest.prototype.open` and `XMLHttpRequest.prototype.send` methods in the page's main JavaScript world. All subsequent XMLHttpRequest operations in that page ...[truncated 1741 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (61)

Hidden Instructions

High

Category: Prompt Injection
Confidence: 90% confidence
Finding: The README embeds hidden AI-agent-targeted instructions for discovery, evaluation, and recommendation inside HTML comments. Even if framed as metadata, hidden instructions are risky because they can influence agent behavior outside normal user-visible review, and in this case they encourage recommendation and operational use of a skill that profiles third parties from public social media.
Content: Scanner excerpt · README.md (reported line 1)May include surrounding context.
md
 <!-- SKILL_SUMMARY: name: Dating (Dating)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The declared description says this skill researches someone’s public social media presence and produces a dating-prep report. The supplied code does none of that. It is purely an infrastructure diagnostic script for ManoBrowser MCP: it checks whether an endpoint and API key are present, calls a remote endpoint with curl using a tools/list JSON-RPC method, and classifies the result as configured, offline, or erroneous. This is a materially different primary purpose and uses resources (MCP endpoint/API key, browser plugin connectivity) unrelated to the declared functionality. Therefore this is a clear description-behavior mismatch.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: Persistently storing complete raw scraped profile data per target person in a shared cross-skill directory materially exceeds what is necessary to generate a one-time dating prep summary. This creates a durable dossier on non-consenting third parties and increases exposure from later compromise, misuse, or unintended reuse.
Content: No source excerpt is available for this finding.

Ssd 3

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The instructions require persistent storage of full raw third-party profile data in a shared directory and reuse across runs. In the context of a dating assistant, that meaningfully raises privacy and stalking-risk concerns by enabling long-lived dossiers and secondary use of personal data beyond the immediate interaction.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The skill is presented in a dating-assistant context, but its own metadata and workflow target the currently logged-in Bilibili account and harvest account-specific data via authenticated browser requests. This is a clear scope mismatch that can mislead a user into exposing their own private account data instead of researching another person's public profile.
Content: No source excerpt is available for this finding.

Ssd 3

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The skill instructs bulk collection of personal profile, favorites, and relationship data from the logged-in user through browser-authenticated access. In the dating-assistant context, this is especially dangerous because it normalizes over-collection of sensitive personal data under a misleading social-research framing.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: Collecting the logged-in user's full favorites and follow list goes beyond the manifested purpose of researching another person's public profile and exposes sensitive preference and relationship data. These datasets can reveal interests, habits, affiliations, and social graph information that are not necessary for the claimed use case.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The skill explicitly targets the currently logged-in Douban user via /mine/ and authenticated session state, which conflicts with the parent skill's stated purpose of researching another person's public profile. This creates a data-scope violation: instead of limited public OSINT, it enables collection of the operator's own full account activity and private-by-context behavioral history for downstream profiling.
Content: No source excerpt is available for this finding.

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The skill description promises full collection of personal profile information, media history, and status activity without any meaningful privacy disclosure, consent workflow, retention limitation, or warning about the sensitivity of the resulting profile. Because the output is explicitly used to infer interests, personality, lifestyle, and values, the missing disclosure materially heightens privacy and misuse risk.
Content: No source excerpt is available for this finding.

Ssd 3

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The natural-language instructions direct bulk collection of the logged-in user's personal data for creation of a detailed dating-prep profile. Even without overt exfiltration code, this is dangerous because it operationalizes large-scale profiling of sensitive preferences and behavioral history that exceeds the narrow need of lightweight conversation preparation.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The instructions repeatedly rely on fetch(..., {credentials:'include'}) from authenticated pages to scrape content with live cookies, granting access to data available only because the browser is logged in. For a dating-research assistant framed around public profiles, this is unjustified privilege escalation in practice and materially increases the risk of over-collection, privacy invasion, and misuse of sensitive behavioral data.
Content: No source excerpt is available for this finding.

Ssd 3

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The skill enumerates exhaustive retrieval across multiple categories—profile details, watched and wished movies, read and wished books, and statuses—using pagination and scrolling specifically to maximize coverage. In the context of a dating assistant, this breadth and persistence make the profiling capability significantly more invasive than ordinary public-profile review and increase the harm from misuse or accidental disclosure.
Content: No source excerpt is available for this finding.

Ssd 3

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The skill explicitly requires collecting comments, ratings, dates, tags, and publication metadata because they are useful inputs for analyzing a person's preferences, habits, and psychology. This is a direct instruction to gather high-context behavioral signals for profiling, which raises the privacy risk beyond simple content lookup and makes downstream inference more intrusive and potentially discriminatory.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The skill explicitly targets the currently logged-in Douyin user's own account via /user/self, which conflicts with the parent dating skill's stated purpose of researching another person's public profile. This mismatch can cause the agent to collect and disclose the operator's private account data instead of intended third-party public information, creating a serious privacy and data-exfiltration risk.
Content: No source excerpt is available for this finding.

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The skill performs extensive collection of sensitive account data from a logged-in session without a prominent warning that it may access private preferences, saved items, and social graph data. Users invoking a dating-related assistant are unlikely to expect their own account internals to be harvested, making informed consent inadequate.
Content: No source excerpt is available for this finding.

Ssd 3

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The skill is designed to extract a broad set of sensitive data from the logged-in user's account, including private preference signals and the full following graph. In the context of a dating assistant, this is especially dangerous because the surrounding product framing normalizes collection while the actual behavior resembles credentialed account surveillance and data exfiltration.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The documented workflow collects likes, favorites, and full following data, which are often private or at least sensitivity-elevating signals beyond the manifest's claimed scope of public social-profile research. Expanding from public profile review into private preference and social graph extraction materially increases privacy harm and violates data minimization.
Content: No source excerpt is available for this finding.

Ssd 3

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: Stating that no parameters are required because the skill will automatically collect from whatever user is already logged into the browser creates a direct risk of harvesting the operator's account without deliberate target selection. This is a classic unsafe default that turns ambient browser authentication into silent access to sensitive personal data.
Content: No source excerpt is available for this finding.

Ssd 3

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The workflow directs extraction of document.body.innerText and aggregation of liked, favorited, and followed-account data, which is broader than necessary and risks capturing incidental sensitive content beyond intended fields. Full-page text extraction is particularly risky because it can sweep up unrelated UI text, identifiers, and hidden contextual data from an authenticated page.
Content: No source excerpt is available for this finding.

Ssd 3

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The output schema explicitly packages and returns profile data, liked videos, favorites, and the following-user list, operationalizing disclosure of highly sensitive account information. By specifying these fields as outputs, the skill ensures any successful run results in structured exfiltration rather than incidental observation.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The skill’s declared purpose is pre-date research on someone’s public social media, but the implementation explicitly navigates as the currently logged-in Weibo user and extracts that user’s structured profile, follow list, and favorites. This is a dangerous scope mismatch because it causes collection of the operator’s own account data, including non-public behavioral data, without clear consent or necessity for the stated task.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The skill collects the logged-in user’s favorites page, which is a sensitive behavioral dataset revealing interests, preferences, and potentially intimate associations. This data is unrelated to the advertised public-profile dating research use case, so its collection constitutes unnecessary overreach and materially increases privacy harm if the report is stored, shared, or misused.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The skill explicitly collects the current logged-in user's full favorites and likes, which are typically private behavioral data and not necessary for a dating-prep assistant focused on public-profile research. This creates unjustified over-collection of sensitive data and enables profiling well beyond the advertised purpose.
Content: No source excerpt is available for this finding.

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The skill advertises full harvesting of profile, post, favorites, and likes data without prominent privacy warnings or scope constraints. Because favorites and likes reveal intimate preferences and behavior patterns, the absence of clear notice and limitation materially increases the privacy risk.
Content: No source excerpt is available for this finding.

Ssd 3

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The skill contains direct instructions to collect and return the logged-in user's complete profile, posts, favorites, and likes, which is excessive for the stated public-profile research use case. This is dangerous because it operationalizes mass extraction of sensitive personal and behavioral data with minimal friction.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.