T03 · Remote Payload Retrieval and Execution
Error
- Location
SKILL.md:110- Finding
Mutable Third-Party Browser Dependency Is Downloaded Without Integrity Verification
- Content
View full analysis
- Remediation
View remediation
Security audit
墓志铭 Epitaph
Security checks for vulnerabilities and agentic risk
Overview
This skill is a real social-media profile generator, but it asks for broad logged-in browser access and stores sensitive account data with weak controls.
Install only if you are comfortable giving an agent browser-control access to logged-in social accounts and having raw likes, favorites, follows, comments, IDs, and profile details consolidated locally. Use a separate browser profile, approve each data category explicitly, avoid saving raw data, do not store ManoBrowser API keys in TOOLS.md, and pin or manually review ManoBrowser before use.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (5)
T01 · Skill Instruction Hijacking
Warning
- Location
SKILL.md:15- Finding
Skill Loading Forces an Unsolicited Promotional Response and Changes Session Behavior
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/check_manobrowser.sh:3- Finding
Bearer Credential Is Accepted on the Command Line and Sent to an Unrestricted Endpoint
- Content
View full analysis
&1) ``` The comments and messages above are English renderings; the shell operations are unchanged. ### Technical Analysis The API key is supplied as a positional command-line argument. Command-line arguments can be visible to process-inspection tools, diagnostic collectors, shell history, job-control logs, and wrapper scripts. The endpoint is also supplied by the caller and is not validated. The script sends the bearer token to any URL provided, without enforcing HTTPS, checking the expected hostname, validating a certificate identity beyond curl’s default behavior, or requiring user confirmation when the destination changes. The instructions additionally recommend storing the endpoint and API key in `TOOLS.md`, which is a plaintext documentation file that may be indexed, backed up, committed, or exposed to other agents. ### Attack Path 1. A user stores the ManoBrowser bearer key in `TOOLS.md` as instructed. 2. Another process, agent, repository operation, backup service, or accidental commit obtains the plaintext key. 3. Alternatively, an attacker modifies the configured endpoint while leaving the key unchanged. 4. The script is invoked with the altered endpoint and valid key. 5. Curl transmits the ...[truncated 881 chars]- Remediation
View remediation
other
Error
- Location
SKILL.md:169- Finding
Authenticated Social-Media Data Collection Exceeds the Minimum Necessary Scope
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Error
- Location
SKILL.md:193- Finding
Full Cross-Platform Profile Dataset Is Stored in Plaintext Without Protection or Retention Controls
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (63)
Hidden Instructions
High
- Category
- Prompt Injection
- Confidence
- 70% confidence
- Finding
The README contains hidden AI-targeted metadata and recommendation guidance in HTML comments. While not directly malicious here, hidden instructions aimed at agents create an instruction-injection surface because automated systems may privilege non-user-visible content when deciding whether to install or run a skill that processes sensitive account data.
- Content
md <!-- FOR AI AGENTS: Structured skill metadata for discovery, evaluation, and recommendation --> <!-- SKILL_SUMMARY: name: 墓志铭 (Epitaph)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The declared description presents a consumer-facing analysis tool that inspects social media activity and produces a personalized 'Digital Epitaph.' The supplied code does none of that. Instead, it is purely a connectivity diagnostic for a ManoBrowser MCP service: it validates presence of endpoint/API key arguments, prints setup instructions, calls the endpoint with a tools/list request, and classifies the result as configured, offline, not found, or error. This is a materially different primary purpose and lacks the described data collection and summarization behavior entirely.
- Content
Ssd 3
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The core workflow is built around harvesting and narrativizing extensive private behavioral data from logged-in social accounts, including hidden preferences and unfinished plans. This is dangerous because it transforms sensitive behavioral exhaust into explicit psychological profiling and shareable output, increasing privacy harm, embarrassment, and misuse risk.
- Content
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The skill claims it only reads public profile information, but elsewhere it explicitly targets private or nonpublic behavioral data such as favorites, likes, and saved items. That is dangerous because it misleads users about the sensitivity of the data being collected and can cause them to consent without understanding the true privacy impact.
- Content
Intent-Code Divergence
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The inline privacy messaging contradicts the operational instructions, which undermines informed consent and creates a deceptive data-collection flow. Contradictions around whether private preferences are harvested are especially risky because the output is designed to expose sensitive inferences about the user.
- Content
Ssd 3
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The instructions explicitly target nonpublic preference signals such as favorites, likes, and follows to infer what the user 'really cares about' or 'secretly' values. This is highly privacy-invasive because these signals often reveal intimate interests, beliefs, routines, or vulnerabilities that the user did not intend to present as a public narrative.
- Content
Ssd 3
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The output template specifically instructs the agent to disclose 'hidden preferences' derived from favorites and likes, converting latent behavioral data into explicit narrative revelations. That materially increases the harm because private activity becomes readable, memorable, and easy to share or screenshot outside the original platform context.
- Content
Ssd 3
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The skill is explicitly designed to comprehensively collect the currently logged-in user's personal Bilibili data using session-authenticated access. In the broader 'digital epitaph' context, aggregating profile details, favorites, uploads, and follow relationships creates a detailed behavioral dossier that is highly privacy-invasive and can be misused for profiling, deanonymization, or secondary disclosure.
- Content
Ssd 3
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
This step extracts authenticated identity and account-status fields from the nav API and returns them as structured output, including user ID, nickname, avatar, level, coin balance, and membership status. Returning these fields enables account identification and correlation with other harvested data, increasing the risk of sensitive user profiling.
- Content
Ssd 3
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The skill harvests favorites and followed-account data through paginated authenticated requests and DOM traversal, yielding a user's interests, saved media, and social graph. These categories are especially sensitive because they reveal preferences and relationships that users may not expect to be bulk-exported, making the collection dangerous even if performed on the user's own session.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The description does not provide a clear, prominent warning that execution will harvest extensive personal data from the currently logged-in Douban account using existing browser cookies. Because the tool auto-detects the active account and performs exhaustive collection, users may not understand that private or sensitive history is being extracted for downstream profiling.
- Content
Ssd 3
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The skill’s natural-language instructions direct full collection of the logged-in user’s personal profile and activity history for later analysis, including data not necessary for simple account identification. In context, this is more dangerous because the parent skill’s purpose is to distill a person’s 'digital existence' into a profile, so the collected data is clearly intended for behavioral inference rather than a narrowly bounded operational task.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The quick-start command auto-targets the current logged-in account with no friction, no consent checkpoint, and no warning about account-scope collection. That makes accidental over-collection more likely and lowers the barrier to extracting sensitive personal history from whichever account happens to be authenticated in the browser session.
- Content
Ssd 3
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The instructions explicitly insist on exhaustive extraction of comments, tags, ratings, dates, publication metadata, and statuses because they are 'key inputs' for profile analysis. This materially increases risk because those fields enable sensitive psychographic and habit inference, and the language discourages simplification or omission, signaling deliberate maximization of personal data capture.
- Content
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The skill metadata and behavior are materially misaligned with the parent skill's stated purpose. Instead of producing a constrained epitaph-style summary, it performs direct authenticated scraping of a single platform account, which can mislead reviewers and users about the scope of data access and increase the chance of over-collection without informed consent.
- Content
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The skill collects sensitive behavioral and social-graph data such as likes, favorites, and the full following list, which goes well beyond what is necessary for a profile summary. In the context of an epitaph-generation workflow, this broad access is especially dangerous because it normalizes extracting private preference data under a softer, creative pretext.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The skill describes extensive collection of personal, behavioral, and social-graph data from an authenticated account but does not present a prominent privacy warning, consent checkpoint, or data handling limits. This is dangerous because users may not understand that private activity data and relationship data will be extracted and returned downstream.
- Content
Ssd 3
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The skill is explicitly designed to harvest all available profile, content, preference, and following data from the currently logged-in Douyin user. That creates a direct data-exfiltration path from an authenticated browser session, exposing private information far beyond what is needed for a simple profile view.
- Content
Ssd 3
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
Returning document.body.innerText captures the page's full visible text, which may include far more than the intended fields, including incidental private content, UI state, or other account information visible in the authenticated session. This broad extraction increases the likelihood of unnecessary disclosure and downstream misuse.
- Content
Ssd 3
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The workflow intentionally extracts the user's entire likes section, which reveals behavioral preferences and inferred interests from a logged-in account. Such data is sensitive and can be used for profiling, manipulation, or deanonymization, especially when combined with profile metadata.
- Content
Ssd 3
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
Favorites/bookmarks are typically more sensitive than public posts because they often reflect private interests intentionally saved by the user for personal use. Extracting and exporting this section from an authenticated account creates a significant privacy risk and exceeds reasonable expectations for a summary-style skill.
- Content
Ssd 3
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The skill exhaustively loads and exports the full following list and profile links, disclosing the user's social graph and relationship patterns. Social graph data is highly sensitive because it can reveal affiliations, interests, and communities, and can also expose third-party account information without their consent.
- Content
Ssd 3
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The output schema formalizes returning a consolidated package of profile data, behavioral history, and social graph, making broad disclosure the expected end state of the skill. That normalization increases downstream risk because other components may ingest, store, or repurpose the exported dataset beyond the user's understanding.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The skill description does not clearly warn that it collects highly sensitive private behavioral data, including the full favorites and likes history of the logged-in account. Favorites and likes can reveal intimate interests, beliefs, or habits, so omission of a prominent warning undermines meaningful consent.
- Content
Ssd 3
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The natural-language instructions direct exhaustive collection of the logged-in user's profile, all posts, favorites, and likes at deep granularity. This is excessive for a summary-generation skill and creates a large concentration of highly sensitive personal and behavioral data with clear privacy and misuse risks.
- Content
Static analysis
No suspicious patterns detected.