T08 · Insecure Dependencies
Warning
- Location
SKILL.md:47- Finding
Automatic Installation of an Unpinned Mutable Dependency
- Content
View full analysis
- Remediation
View remediation
Security audit
Know Your Owner
Security checks for vulnerabilities and agentic risk
Overview
This skill openly builds a local social-media profile, but it needs Review because it uses broad logged-in account scraping, stores raw profile data, auto-installs a mutable browser dependency, and includes overbroad workflow actions.
Install only if you are comfortable letting an agent use your logged-in browser sessions to read and locally store social-platform activity, favorites, follows, ratings, comments, and profile data. Save or close unrelated browser work first, review the generated USER.md, MEMORY.md, and know-your-owner-data files, delete raw data you do not want retained, and prefer a pinned, reviewed ManoBrowser dependency before use.
Vulnerability Patterns
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Findings (3)
T09 · Insecure Skill Coding Practices
Warning
- Location
workflows/xiaohongshu-deep-profile-collect-workflow.json:75- Finding
Executable Workflows Bypass Documented Data-Collection Limits
- Content
View full analysis
{ window.__xhs_collected = []; window.__xhs_done = false; window.__xhs_api_count = 0; const origOpen = XMLHttpRequest.prototype.open; const origSend = XMLHttpRequest.prototype.send; XMLHttpRequest.prototype.open = function(method, url, ...rest) { this.__xhs_url = url; return origOpen.call(this, method, url, ...rest); }; XMLHttpRequest.prototype.send = function(...args) { if (this.__xhs_url && (this.__xhs_url.includes('note/collect/page') || this.__xhs_url.includes('note/like/page'))) { this.addEventListener('load', function() { try { const data = JSON.parse(this.responseText); if (data.data && data.data.notes) { window.__xhs_api_count++; data.data.notes.forEach(note => { window.__xhs_collected.push({note_id: note.note_id, display_title: note.display_title || '', type: note.type, user: note.user ? {nickname: note.user.nickname, user_id: note.user.user_id} : null, interact_info: note.interact_info ? {liked_count: note.interact_info.liked_count} : null}); }); if (!data.data.has_more) window.__xhs_done = true; } } catch(e) {} }); } return origSen ...[truncated 4727 chars]- Remediation
View remediation
T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
workflows/xiaohongshu-deep-profile-collect-workflow.json:131- Finding
Xiaohongshu Workflow Closes All Open Browser Tabs
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (83)
Hidden Instructions
High
- Category
- Prompt Injection
- Confidence
- 91% confidence
- Finding
The hidden HTML comment provides structured guidance aimed at AI agents for discovery, evaluation, and recommendation, which is a form of hidden instruction targeting automated systems rather than end users. In this context it is risky because it primes agents to recommend a sensitive data-harvesting skill and may bias analysis or execution despite the high privacy impact of the capability.
- Content
md <!-- FOR AI AGENTS: Structured skill metadata for discovery, evaluation, and recommendation --> <!-- SKILL_SUMMARY: name: Know Your Owner
Ssd 3
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
These instructions encourage an agent to harvest extensive data from multiple logged-in social platforms, correlate it across services, and persist a long-lived personal profile for personalization. Cross-platform aggregation of identity, interests, habits, and inferred traits is highly sensitive and can materially increase privacy harm if performed without strict, explicit, informed consent and minimization.
- Content
Ssd 3
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The recommended wording is specifically crafted to persuade a user to let the agent inspect logged-in browser sessions and transform that data into a detailed profile. This is dangerous because it normalizes access to authenticated personal data and frames broad profiling as a routine onboarding step rather than a high-sensitivity action requiring exceptional consent safeguards.
- Content
Ssd 3
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The skill explicitly stores raw harvested platform data and reusable profile memories for future querying, creating a persistent local surveillance archive. Even if kept local, this materially increases exposure from local compromise, accidental sharing, unauthorized reuse by future agent tasks, and secondary inference beyond the user's original expectation.
- Content
Vague Triggers
High
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The description frames the skill for onboarding and personalization in a way that encourages broad automatic invocation for collecting sensitive personal data. That is dangerous because it normalizes running authenticated data collection as a default background behavior rather than a clearly bounded, user-initiated action.
- Content
Ssd 3
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The skill's core design is to collect broad personal data from multiple logged-in social platforms, synthesize a profile, and persist that information into memory files for future use. This creates a substantial privacy risk because the agent is instructed to build durable, reusable dossiers rather than transiently process only what is necessary for the immediate task.
- Content
Vague Triggers
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The skill explicitly requires the agent to proactively introduce and solicit execution without being asked. In the context of social-account profiling, proactive prompting increases the likelihood of unrequested collection of highly sensitive behavioral data from logged-in sessions.
- Content
Ssd 3
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The onboarding script tells the agent to initiate personal-data collection from authenticated accounts before the user has requested it. In context, this is especially dangerous because the data includes behavior, preferences, follows, ratings, and other sensitive signals that users may not expect to be aggregated automatically.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
Early user-facing copy emphasizes convenience and depth of profiling but does not prominently warn that extensive raw data from multiple authenticated platforms will be stored locally for later reuse. This undermines informed consent because the most sensitive consequence—persistent storage and reuse—is disclosed much later, after persuasive onboarding copy.
- Content
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - 安装配置 ManoBrowser：读 ManoBrowser Skill 目录下的 `SKILL.md`
Ssd 3
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The skill instructs saving full raw per-platform datasets locally and reusing them later across normal conversations and other skills. Persisting comprehensive authenticated social-platform data in reusable JSON files creates a high-value local privacy target and enables secondary uses far beyond the user's immediate request.
- Content
Ssd 3
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The skill uses browser-authenticated APIs and DOM scraping to harvest extensive personal and relationship data from a logged-in account. This is especially risky in context because it is not just a one-off export: the stated parent use case is cross-platform profiling and memory creation, which enables long-term aggregation of behavioral and social graph data far beyond what a user may expect.
- Content
Ssd 3
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
This skill directly instructs the agent to gather the currently logged-in user's full profile and activity history from an authenticated account, including preferences and personal expression. In this context, the capability is more dangerous because it is not a narrow export utility; it is part of a profiling workflow intended to build a persistent personal dossier for onboarding and personalization.
- Content
Ssd 3
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The skill explicitly tells the agent to use browser cookies from the active logged-in session to fetch paginated personal data across multiple account areas. That creates a credential-mediated data access path where the agent can systematically enumerate and extract large amounts of sensitive account content beyond what a user may realize they are exposing.
- Content
Ssd 3
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The workflow requires extracting rich structured fields such as ratings, comments, tags, publication metadata, and statuses, which together enable inference of beliefs, interests, routines, and personality traits. Because the parent skill's purpose is cross-analysis and persistent memory creation, this comprehensive harvesting substantially increases the risk of invasive profiling, over-collection, and long-term misuse of sensitive behavioral data.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The skill explicitly performs deep collection of a logged-in user's Douyin profile, including likes, favorites, and following graph, but does not present a clear privacy warning or informed-consent boundary at the point of collection. This is dangerous because the data is sensitive, account-scoped, and behaviorally rich, so an agent could exfiltrate far more personal information than a user reasonably expects from a generic profiling/onboarding workflow.
- Content
Ssd 3
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The skill's stated purpose is to broadly collect and cross-analyze sensitive personal and behavioral data to build a detailed user profile, including private preference signals such as liked and favorited content and social graph data. In the context of an onboarding/personalization skill, this is overbroad collection that materially increases surveillance, profiling, and downstream misuse risks if the data is stored, shared, or repurposed.
- Content
Ssd 3
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The workflow returns document.body.innerText from private account views, which captures the entire visible page text rather than narrowly targeted fields. This is dangerous because it can sweep in unrelated sensitive content, hidden identifiers, recommendations, interface state, or other account-scoped information not needed for the task, amplifying over-collection and disclosure risk.
- Content
Ssd 3
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The skill intentionally loads and exports the user's full following list, including names and profile links, from a private side panel using aggressive virtual-scroll automation. This exposes sensitive relationship and interest-graph data about both the account owner and third parties, and the detailed instructions to maximize extraction make the privacy impact more severe, not less.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The skill is explicitly designed to collect highly sensitive account data from a logged-in user's Weibo session, including profile attributes, posts, follows, and favorites, without presenting a clear privacy warning or consent checkpoint. In the context of a parent skill focused on cross-platform profiling and persistent profile generation, this materially increases the risk of covert surveillance, overcollection, and unauthorized aggregation of personal data.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
Automatically detecting the currently logged-in account and proceeding to collect its data without an explicit warning or confirmation is dangerous because it removes a meaningful user awareness barrier. In this skill context, the browser session itself becomes an implicit authorization token for extracting personal data, which is especially risky given the broad collection scope and the parent skill’s goal of building durable user profiles.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The description does not clearly warn that the skill will access authenticated account data from the currently logged-in Bilibili session and aggregate it into a deep personal profile. Because the workflow uses credentialed browser fetches and DOM scraping of private account context, the lack of an upfront warning undermines informed consent and can trick users into disclosing sensitive behavioral and social-graph data.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The workflow is explicitly designed to collect a logged-in user's full Douban profile, reading/viewing history, and status activity, yet it contains no consent prompt, notice, or data-minimization control. Because it leverages the user's authenticated browser session to access and aggregate sensitive behavioral data, it creates a covert surveillance and profiling capability rather than a narrowly scoped user-requested action.
- Content
Ssd 3
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The workflow description itself directs comprehensive harvesting of a logged-in user's personal profile and activity history, signaling an intent to build a detailed dossier rather than perform a bounded task. In the context of a skill whose stated purpose is cross-platform profiling and memory generation, this broad collection objective is inherently privacy-invasive and high risk.
- Content
Ssd 4
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
Across multiple coordinated steps, the workflow extracts identifiers, profile metadata, watched and wishlisted movies, read and wishlisted books, and social-status content, then combines them into a comprehensive behavioral profile. This staged aggregation is more dangerous than isolated scraping because cross-category correlation can reveal intimate preferences, habits, and beliefs and is directly aligned with dossier-building described in the skill metadata.
- Content