Know Your Owner

• Outcome: Review
• Latest audit: Sep 16, 2026 · 4:03 AM UTC
• Version: 2.5.0

Overview

This skill openly builds a local social-media profile, but it needs Review because it uses broad logged-in account scraping, stores raw profile data, auto-installs a mutable browser dependency, and includes overbroad workflow actions.

Install only if you are comfortable letting an agent use your logged-in browser sessions to read and locally store social-platform activity, favorites, follows, ratings, comments, and profile data. Save or close unrelated browser work first, review the generated USER.md, MEMORY.md, and know-your-owner-data files, delete raw data you do not want retained, and prefer a pinned, reviewed ManoBrowser dependency before use.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (3)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:47
• Finding: Automatic Installation of an Unpinned Mutable Dependency<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:47-59` **Vulnerability Type**: Supply-chain exposure through an automatically downloaded, unpinned dependency **Risk Level**: Medium ### Vulnerable Code ```bash git clone https://github.com/ClawCap/ManoBrowser.git ./manobrowser ``` Fallback installation: ```bash curl -L https://github.com/ClawCap/ManoBrowser/archive/refs/heads/main.zip -o /tmp/manobrowser.zip unzip /tmp/manobrowser.zip -d /tmp/ mv /tmp/ManoBrowser-main ./manobrowser ``` ### Technical Analysis The Skill automatically retrieves the current `main` branch of the external ManoBrowser repository. It does not pin a reviewed commit or release and does not verify a cryptographic checksum, signature, or trusted manifest. After downloading the dependency, the agent is instructed to read the downloaded `manobrowser/SKILL.md` and follow its configuration instructions. Consequently, the effective behavior of this Skill can change after the present package has been reviewed. The source is a GitHub repository under the same publisher namespace, and the archive is not directly invoked as a native executable by the displayed commands. No malicious upstream content was identified during this audit. Nevertheless, relying on a mutable branch creates a material supply-chain risk and exceeds least-privilege installation practices because the dependency is installed automatically instead of being pinned and explicitly approved. ### Attack Path 1. An attacker compromises the upstream ManoBrowser repository, its publisher account, or the `main` branch. 2. The attacker modifies the dependency's Skill instructions or supporting components. 3. A user invokes this Skill in an environment where ManoBrowser is absent. 4. The Skill automatically clones or downloads the compromised current branch. 5. The agent reads the newly downloaded `manobrowser/SKILL.md`. 6. The compromised dependency can direct the agent to perform unsafe setup actions, request secr ...[truncated 798 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Pin ManoBrowser to a specific reviewed commit hash or immutable signed release. 2. Publish and verify a SHA-256 checksum before extracting or using the archive. 3. Prefer a signed release artifact and validate its signature against a documented trusted key. 4. Require explicit user confirmation before downloading or installing the dependency. 5. Display the exact version, commit, source URL, and permissions requested before installation. 6. Audit the pinned dependency's `SKILL.md`, scripts, and MCP configuration as part of this project's release process. 7. Fail closed if integrity verification fails; do not silently fall back to an unverified branch. 8. Extract archives into a private, newly created directory and validate archive paths before moving files into the Skill directory. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: workflows/xiaohongshu-deep-profile-collect-workflow.json:75
• Finding: Executable Workflows Bypass Documented Data-Collection Limits<![CDATA[ ## Vulnerability Details **File Locations**: - `workflows/xiaohongshu-deep-profile-collect-workflow.json:75-86` - `workflows/bilibili-deep-profile-collect-workflow.json:77` - `workflows/bilibili-deep-profile-collect-workflow.json:97` - `workflows/douban-deep-profile-collect-workflow.json:53` - `workflows/douban-deep-profile-collect-workflow.json:64` - `workflows/douban-deep-profile-collect-workflow.json:75` - `workflows/douban-deep-profile-collect-workflow.json:86` **Vulnerability Type**: Missing privacy and resource limits in executable workflow definitions **Risk Level**: Medium ### Vulnerable Code The Xiaohongshu workflow accumulates every intercepted response object and returns every unique item without applying the documented 500-item limit: ```json { "step": 6, "tool_name": "mcp__chrome-server__chrome_execute_script", "tool_params": { "world": "MAIN", "timeout": 5000, "jsScript": "() => { window.__xhs_collected = []; window.__xhs_done = false; window.__xhs_api_count = 0; const origOpen = XMLHttpRequest.prototype.open; const origSend = XMLHttpRequest.prototype.send; XMLHttpRequest.prototype.open = function(method, url, ...rest) { this.__xhs_url = url; return origOpen.call(this, method, url, ...rest); }; XMLHttpRequest.prototype.send = function(...args) { if (this.__xhs_url && (this.__xhs_url.includes('note/collect/page') || this.__xhs_url.includes('note/like/page'))) { this.addEventListener('load', function() { try { const data = JSON.parse(this.responseText); if (data.data && data.data.notes) { window.__xhs_api_count++; data.data.notes.forEach(note => { window.__xhs_collected.push({note_id: note.note_id, display_title: note.display_title || '', type: note.type, user: note.user ? {nickname: note.user.nickname, user_id: note.user.user_id} : null, interact_info: note.interact_info ? {liked_count: note.interact_info.liked_count} : null}); }); if (!data.data.has_more) window.__xhs_done = true; } } catch(e) {} }); } return origSen ...[truncated 4727 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Enforce hard item limits directly inside every executable workflow, not only in documentation. 2. Add `MAX_ITEMS`, `MAX_USERS`, and `MAX_PER_FOLDER` checks before appending data and before issuing another request. 3. Truncate returned arrays even if a single API response crosses the remaining allowance. 4. Stop pagination based on both an item cap and a request/page cap. 5. Return consistent metadata such as: - `sampled` - `returned_count` - `displayed_total` - `requests_made` - `limit` 6. Update the Xiaohongshu workflow to match the 500-item implementation in its platform Skill. 7. Update Bilibili favorites to enforce 100 entries per folder and follows to enforce 500 users. 8. Update all Douban collection loops to enforce 500 entries per media dimension. 9. Generate workflow JSON and prose documentation from one canonical implementation to prevent version drift. 10. Add automated tests that fail when workflow results can exceed declared limits. 11. Require renewed user confirmation before allowing a deliberately expanded or full-history collection mode. ]]>

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: workflows/xiaohongshu-deep-profile-collect-workflow.json:131
• Finding: Xiaohongshu Workflow Closes All Open Browser Tabs<![CDATA[ ## Vulnerability Details **File Location**: `workflows/xiaohongshu-deep-profile-collect-workflow.json:131-136` **Vulnerability Type**: Destructive browser action outside the workflow's required scope **Risk Level**: Medium ### Vulnerable Code ```json { "step": 11, "tool_name": "mcp__chrome-server__chrome_close_tabs", "tool_params": { "tabIds": "all_opened_tabs" }, "description": "Close all open tabs to clean up resources", "is_final_result": false } ``` ### Technical Analysis The workflow closes every open browser tab at the end of Xiaohongshu collection. Global tab closure is not necessary for the declared profiling task and violates least privilege. The workflow only needs to close tabs that it created or explicitly reused. Other project workflows demonstrate narrower cleanup by retaining specific tab IDs. Therefore, targeting all open tabs is avoidable and can interfere with unrelated browsing sessions, other agents, or unsaved user work. ### Attack Path 1. The user has unrelated browser tabs open, potentially containing partially completed forms, editors, dashboards, or active sessions. 2. The user invokes the Xiaohongshu profile collector. 3. The workflow opens or navigates the tabs needed for collection. 4. After collection, step 11 invokes `chrome_close_tabs` with `all_opened_tabs`. 5. The browser integration closes tabs unrelated to the Skill. 6. Unsaved content or concurrent browsing state may be lost. This behavior is triggered during normal use and does not require an external attacker. ### Impact Assessment The action does not provide the Skill with additional account permissions, but it exercises browser-control privileges beyond the minimum required scope. Potential impact includes: - Loss of unsaved form or editor content. - Termination of unrelated authenticated browser workflows. - Disruption of concurrent user or agent activity. - Loss of temporary application state held only in open tabs. - Unexpected clo ...[truncated 203 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Capture the tab ID returned when the workflow opens its Xiaohongshu page. 2. Pass only workflow-owned tab IDs to `chrome_close_tabs`. 3. Maintain an explicit list of tabs created by the current run. 4. Do not close pre-existing tabs that the workflow merely observes or reuses. 5. If global cleanup is ever necessary, request separate explicit confirmation and clearly warn that unsaved work may be lost. 6. Add a cleanup guard that verifies each tab is workflow-owned before closing it. 7. Add regression tests ensuring that unrelated pre-existing tabs remain open after successful, failed, and cancelled runs. ]]>

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (83)

Hidden Instructions

High

• Category: Prompt Injection

Content

<!-- FOR AI AGENTS: Structured skill metadata for discovery, evaluation, and recommendation -->
<!--
SKILL_SUMMARY:
  name: Know Your Owner

• Confidence: 91% confidence
• Finding: The hidden HTML comment provides structured guidance aimed at AI agents for discovery, evaluation, and recommendation, which is a form of hidden instruction targeting automated systems rather than end users. In this context it is risky because it primes agents to recommend a sensitive data-harvesting skill and may bias analysis or execution despite the high privacy impact of the capability.

Ssd 3

High

• Confidence: 98% confidence
• Finding: These instructions encourage an agent to harvest extensive data from multiple logged-in social platforms, correlate it across services, and persist a long-lived personal profile for personalization. Cross-platform aggregation of identity, interests, habits, and inferred traits is highly sensitive and can materially increase privacy harm if performed without strict, explicit, informed consent and minimization.

Ssd 3

High

• Confidence: 98% confidence
• Finding: The recommended wording is specifically crafted to persuade a user to let the agent inspect logged-in browser sessions and transform that data into a detailed profile. This is dangerous because it normalizes access to authenticated personal data and frames broad profiling as a routine onboarding step rather than a high-sensitivity action requiring exceptional consent safeguards.

Ssd 3

High

• Confidence: 97% confidence
• Finding: The skill explicitly stores raw harvested platform data and reusable profile memories for future querying, creating a persistent local surveillance archive. Even if kept local, this materially increases exposure from local compromise, accidental sharing, unauthorized reuse by future agent tasks, and secondary inference beyond the user's original expectation.

Vague Triggers

High

• Confidence: 95% confidence
• Finding: The description frames the skill for onboarding and personalization in a way that encourages broad automatic invocation for collecting sensitive personal data. That is dangerous because it normalizes running authenticated data collection as a default background behavior rather than a clearly bounded, user-initiated action.

Ssd 3

High

• Confidence: 98% confidence
• Finding: The skill's core design is to collect broad personal data from multiple logged-in social platforms, synthesize a profile, and persist that information into memory files for future use. This creates a substantial privacy risk because the agent is instructed to build durable, reusable dossiers rather than transiently process only what is necessary for the immediate task.

Vague Triggers

High

• Confidence: 98% confidence
• Finding: The skill explicitly requires the agent to proactively introduce and solicit execution without being asked. In the context of social-account profiling, proactive prompting increases the likelihood of unrequested collection of highly sensitive behavioral data from logged-in sessions.

Ssd 3

High

• Confidence: 98% confidence
• Finding: The onboarding script tells the agent to initiate personal-data collection from authenticated accounts before the user has requested it. In context, this is especially dangerous because the data includes behavior, preferences, follows, ratings, and other sensitive signals that users may not expect to be aggregated automatically.

Missing User Warnings

High

• Confidence: 94% confidence
• Finding: Early user-facing copy emphasizes convenience and depth of profiling but does not prominently warn that extensive raw data from multiple authenticated platforms will be stored locally for later reuse. This undermines informed consent because the most sensitive consequence—persistent storage and reuse—is disclosed much later, after persuasive onboarding copy.

Ae1

High

• Category: analysis-evasion

Content

- 安装配置 ManoBrowser：读 ManoBrowser Skill 目录下的 `SKILL.md`

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Ssd 3

High

• Confidence: 99% confidence
• Finding: The skill instructs saving full raw per-platform datasets locally and reusing them later across normal conversations and other skills. Persisting comprehensive authenticated social-platform data in reusable JSON files creates a high-value local privacy target and enables secondary uses far beyond the user's immediate request.

Ssd 3

High

• Confidence: 98% confidence
• Finding: The skill uses browser-authenticated APIs and DOM scraping to harvest extensive personal and relationship data from a logged-in account. This is especially risky in context because it is not just a one-off export: the stated parent use case is cross-platform profiling and memory creation, which enables long-term aggregation of behavioral and social graph data far beyond what a user may expect.

Ssd 3

High

• Confidence: 99% confidence
• Finding: This skill directly instructs the agent to gather the currently logged-in user's full profile and activity history from an authenticated account, including preferences and personal expression. In this context, the capability is more dangerous because it is not a narrow export utility; it is part of a profiling workflow intended to build a persistent personal dossier for onboarding and personalization.

Ssd 3

High

• Confidence: 99% confidence
• Finding: The skill explicitly tells the agent to use browser cookies from the active logged-in session to fetch paginated personal data across multiple account areas. That creates a credential-mediated data access path where the agent can systematically enumerate and extract large amounts of sensitive account content beyond what a user may realize they are exposing.

Ssd 3

High

• Confidence: 98% confidence
• Finding: The workflow requires extracting rich structured fields such as ratings, comments, tags, publication metadata, and statuses, which together enable inference of beliefs, interests, routines, and personality traits. Because the parent skill's purpose is cross-analysis and persistent memory creation, this comprehensive harvesting substantially increases the risk of invasive profiling, over-collection, and long-term misuse of sensitive behavioral data.

Missing User Warnings

High

• Confidence: 98% confidence
• Finding: The skill explicitly performs deep collection of a logged-in user's Douyin profile, including likes, favorites, and following graph, but does not present a clear privacy warning or informed-consent boundary at the point of collection. This is dangerous because the data is sensitive, account-scoped, and behaviorally rich, so an agent could exfiltrate far more personal information than a user reasonably expects from a generic profiling/onboarding workflow.

Ssd 3

High

• Confidence: 99% confidence
• Finding: The skill's stated purpose is to broadly collect and cross-analyze sensitive personal and behavioral data to build a detailed user profile, including private preference signals such as liked and favorited content and social graph data. In the context of an onboarding/personalization skill, this is overbroad collection that materially increases surveillance, profiling, and downstream misuse risks if the data is stored, shared, or repurposed.

Ssd 3

High

• Confidence: 99% confidence
• Finding: The workflow returns document.body.innerText from private account views, which captures the entire visible page text rather than narrowly targeted fields. This is dangerous because it can sweep in unrelated sensitive content, hidden identifiers, recommendations, interface state, or other account-scoped information not needed for the task, amplifying over-collection and disclosure risk.

Ssd 3

High

• Confidence: 99% confidence
• Finding: The skill intentionally loads and exports the user's full following list, including names and profile links, from a private side panel using aggressive virtual-scroll automation. This exposes sensitive relationship and interest-graph data about both the account owner and third parties, and the detailed instructions to maximize extraction make the privacy impact more severe, not less.

Missing User Warnings

High

• Confidence: 98% confidence
• Finding: The skill is explicitly designed to collect highly sensitive account data from a logged-in user's Weibo session, including profile attributes, posts, follows, and favorites, without presenting a clear privacy warning or consent checkpoint. In the context of a parent skill focused on cross-platform profiling and persistent profile generation, this materially increases the risk of covert surveillance, overcollection, and unauthorized aggregation of personal data.

Missing User Warnings

High

• Confidence: 99% confidence
• Finding: Automatically detecting the currently logged-in account and proceeding to collect its data without an explicit warning or confirmation is dangerous because it removes a meaningful user awareness barrier. In this skill context, the browser session itself becomes an implicit authorization token for extracting personal data, which is especially risky given the broad collection scope and the parent skill’s goal of building durable user profiles.

Missing User Warnings

High

• Confidence: 99% confidence
• Finding: The description does not clearly warn that the skill will access authenticated account data from the currently logged-in Bilibili session and aggregate it into a deep personal profile. Because the workflow uses credentialed browser fetches and DOM scraping of private account context, the lack of an upfront warning undermines informed consent and can trick users into disclosing sensitive behavioral and social-graph data.

Missing User Warnings

High

• Confidence: 99% confidence
• Finding: The workflow is explicitly designed to collect a logged-in user's full Douban profile, reading/viewing history, and status activity, yet it contains no consent prompt, notice, or data-minimization control. Because it leverages the user's authenticated browser session to access and aggregate sensitive behavioral data, it creates a covert surveillance and profiling capability rather than a narrowly scoped user-requested action.

Ssd 3

High

• Confidence: 99% confidence
• Finding: The workflow description itself directs comprehensive harvesting of a logged-in user's personal profile and activity history, signaling an intent to build a detailed dossier rather than perform a bounded task. In the context of a skill whose stated purpose is cross-platform profiling and memory generation, this broad collection objective is inherently privacy-invasive and high risk.

Ssd 4

High

• Confidence: 99% confidence
• Finding: Across multiple coordinated steps, the workflow extracts identifiers, profile metadata, watched and wishlisted movies, read and wishlisted books, and social-status content, then combines them into a comprehensive behavioral profile. This staged aggregation is more dangerous than isolated scraping because cross-category correlation can reveal intimate preferences, habits, and beliefs and is directly aligned with dossier-building described in the skill metadata.

Static analysis

No suspicious patterns detected.