Security audit

浏览器自动化工具-专业版

Security checks for vulnerabilities and agentic risk

Overview

This skill openly describes powerful browser automation, but it includes scraping-evasion and bulk publishing workflows without enough authorization, privacy, or user-control guardrails.

Install only if you have a legitimate, authorized browser automation use case and can constrain it to systems and accounts you are allowed to automate. Review any use of stealth, proxies, CAPTCHA solving, scraping, screenshots, publishing, and webhooks carefully; keep credentials in environment variables or a secret manager and avoid copying the hardcoded-key example.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

Intent-Code Divergence

Medium

Confidence: 98% confidence
Finding: The documentation’s security guidance says not to hardcode API keys, yet the included Python example embeds service credentials directly in the sample data structure. This is dangerous because users often copy examples verbatim, which normalizes insecure secret handling and can lead to credential exposure in source control, logs, or shared artifacts.

Vague Triggers

Medium

Confidence: 84% confidence
Finding: The skill description uses broad activation language such as improving efficiency, automation, batch processing, and workflow optimization, which overlaps with many ordinary user requests. In an agent ecosystem, this can cause over-invocation of a high-risk skill that has exec, write, and network-capable browser automation features, increasing the chance of unintended external actions.

Missing User Warnings

High

Confidence: 95% confidence
Finding: The documentation provides workflows for scraping protected sites, batch posting to multiple platforms, writing files, taking screenshots, and sending webhook alerts, but does not prominently require user authorization, account ownership, consent, or privacy review. This is dangerous because it enables impactful actions against external systems and accounts with little friction, making misuse and accidental policy violations more likely.

Ssd 2

Medium

Confidence: 97% confidence
Finding: The skill explicitly advertises stealth mode, anti-detection, proxy pools, and CAPTCHA handling as supported capabilities for browser automation. Those features materially facilitate bypassing anti-bot controls and access restrictions on third-party sites, increasing the likelihood of unauthorized scraping, account abuse, or evasion of platform protections.

Ssd 2

Medium

Confidence: 98% confidence
Finding: The best-practices section gives operational advice for avoiding detection during scraping, including stealth, proxy rotation, randomized delays, and fingerprint rotation. This goes beyond neutral automation documentation and directly instructs users on evading defensive controls, which meaningfully lowers the barrier to abusive scraping or fraud workflows.

External Transmission

Medium

Category: Data Exfiltration
Content: FAIL_RATE=$(echo "scale=2; $FAILED * 100 / $COUNT" | bc) if [ "$(echo "$FAIL_RATE > 20" | bc)" -eq 1 ]; then echo "[告警] 失败率 ${FAIL_RATE}% 超过阈值,请检查代理池与目标站点" curl -X POST "$ALERT_WEBHOOK" -d "{\"text\":\"采集失败率 ${FAIL_RATE}%\"}" fi fi done <<< "$URLS"
Confidence: 88% confidence
Finding: The example transmits status data to an arbitrary webhook URL via curl without documenting trust boundaries, payload sensitivity, destination validation, or user approval. In a skill that also performs scraping and monitoring, this creates a straightforward path for exfiltrating operational data or sensitive derived results to external services.

Static analysis

No suspicious patterns detected.