cookie-manager

• Outcome: Review
• Latest audit: Aug 15, 2026 · 3:56 AM UTC
• Version: 1.0.0

Overview

The skill is a real cookie operations manager, but it handles live authentication cookies with broad automatic writes, plaintext persistence, and configurable outbound notifications that need review before installation.

Install only in a tightly controlled operations environment. Treat it as a privileged credential-management tool: restrict who can invoke it, review PORTAL_NOTIFY_URL and XIANYU_AUTO_REPLY_URL, protect .env and global_config.yml, prefer a secret manager for cookies and keys, and require explicit approval or dry-run behavior before sync, recovery, or degraded-mode actions in production.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain

Findings (16)

Tainted flow: 'req' from os.environ.get (line 566, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow

Content

headers={"Content-Type": "application/json"},
            method="POST",
        )
        with urllib.request.urlopen(req, timeout=5) as resp:
            if resp.status == 200:
                logger.info(f"[cookie_keepalive] cookie_expired通知推送成功: {platform}/{effective_tenant}")
            else:

• Confidence: 93% confidence
• Finding: The notification URL is taken from the PORTAL_NOTIFY_URL environment variable and used directly in urllib.request.urlopen() without validation or allowlisting. An attacker who can influence the runtime environment can redirect these POSTs to an arbitrary host, causing SSRF and exfiltration of tenant/account/platform metadata from a privileged internal process.

Tainted flow: 'req' from os.environ.get (line 566, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow

Content

headers={"Content-Type": "application/json"},
                    method="POST",
                )
                with urllib.request.urlopen(req, timeout=5) as resp:
                    if resp.status == 200:
                        logger.info(f"[cookie_keepalive] 通知推送成功: {platform}")
                    else:

• Confidence: 93% confidence
• Finding: This code path also sends a POST request to a URL derived from PORTAL_NOTIFY_URL without verifying that the destination is trusted. In an agent/deployment setting, environment variables are often externally controlled, so this becomes an SSRF sink and a metadata exfiltration path from the keepalive service.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence
• Finding: The skill declares only [read, exec], but the documented behavior clearly includes reading environment secrets, reading and writing local files, making network requests, and invoking shell commands. This permission mismatch is dangerous because it prevents operators and policy engines from accurately understanding the skill's effective access, allowing high-risk actions such as credential handling, remote synchronization, and operational state changes to occur without explicit declaration.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence
• Finding: The documented purpose presents the skill as a cookie keepalive/health manager, but the behavior extends into QR-based login acquisition, secret generation and persistence, database writes, portal notifications, admin API authentication, remote cookie injection, and pausing/resuming business cron groups. This is dangerous because users may invoke the skill expecting passive health checks while it can materially alter credentials, infrastructure state, and downstream systems beyond the described scope.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The module claims to activate and deactivate a degradation mode by pausing and resuming publishing Cron jobs, but the implementation only writes a state file, logs, and sends alerts. In an incident, operators may believe risky publishing has been stopped when it has not, causing continued use of expired cookies, failed actions, or uncontrolled downstream automation during a platform-wide authentication outage.

Description-Behavior Mismatch

Medium

• Confidence: 91% confidence
• Finding: The recovery plan advertises concrete remediation actions such as QR-code cookie recovery and keepalive validation, but only returns a static batch description. This creates a dangerous gap between documented incident response and actual capability, which can delay containment and recovery when authentication failures affect multiple platforms.

Context-Inappropriate Capability

Medium

• Confidence: 91% confidence
• Finding: The script can generate and persist a new encryption key into the shared .env automatically, modifying a sensitive shared configuration store as a side effect of routine cookie management. In a multi-skill or multi-tenant environment, this broad write capability can interfere with other components, create configuration drift, and unexpectedly change the trust boundary around secret handling.

Vague Triggers

Medium

• Confidence: 88% confidence
• Finding: The trigger phrases include broad terms such as 'Cookie检查' and 'Cookie同步', which are likely to match routine conversational requests. In a skill that can modify cookie stores, sync to multiple endpoints, and trigger operational changes, ambiguous triggers increase the risk of accidental invocation and unintended state changes.

Missing User Warnings

High

• Confidence: 94% confidence
• Finding: The skill description does not clearly warn that it will automatically modify cookie data and propagate synchronized updates across local files and multiple remote endpoints. Because cookies are authentication artifacts, silent mutation and distribution of them can lead to credential corruption, unauthorized propagation, or wider compromise if a bad source is treated as authoritative.

Missing User Warnings

High

• Confidence: 95% confidence
• Finding: The emergency mode can pause cron publishing, alter delivery behavior, and move operations into degraded/manual workflows, but this operational impact is not prominently disclosed as a warning. Hidden business-process side effects are dangerous because a user may request cookie handling and unintentionally trigger service disruption or workflow changes across production systems.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The example shows a credential-maintenance command that can touch cookies across multiple platforms and potentially trigger synchronization or recovery behaviors, but it provides no warning that running it may modify authentication state or affect live tenant accounts. In this skill's context, the omission is more dangerous because the skill is explicitly designed to manage production cookies, perform keep-alive actions, and auto-repair state across several backends.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The emergency example describes degraded-mode activation, pausing tasks, backup credential switching, and manual recovery without any warning that the command can change service behavior and interrupt workloads. Given this skill's operational scope, such examples could be copied directly into production, causing unintended service-impacting changes under the guise of a simple example.

Missing User Warnings

Low

• Confidence: 84% confidence
• Finding: On successful keepalive, the script sends tenant and platform metadata to a configurable notification endpoint without any visible consent or trust enforcement in this code path. In multi-tenant agent deployments, this creates an avoidable metadata leak, and because the endpoint is environment-controlled it compounds the SSRF risk.

Missing User Warnings

Low

• Confidence: 80% confidence
• Finding: Expired-cookie alerts include account and tenant identifiers and are sent through external notification mechanisms without any apparent redaction or access policy in this file. In a multi-tenant credential-management context, leaking identity and operational state can expose sensitive customer metadata and platform usage patterns.

Missing User Warnings

High

• Confidence: 99% confidence
• Finding: The script writes the full cookie string in plaintext to global_config.yml, explicitly disabling encryption for a live authentication artifact. Anyone with filesystem, backup, log, or config-management access to that file can recover the cookie and impersonate the account, which is especially dangerous in an automation environment managing tenant cookies.

Credential Access

High

• Category: Privilege Escalation

Content

| 异常 | 处理 | code |
|:-----|:-----|:-----|
| 无Cookie配置 | 返回失败+提示配置.env | NO_COOKIE |
| httpx未安装 | 仅格式检查,告警提示安装 | HTTPX_NOT_INSTALLED |
| 网络超时 | 标记为TIMEOUT,下次重试 | TIMEOUT |
| fishclaw-mcp不可用 | 跳过深度检查,仅HTTP检查 | MCP_UNAVAILABLE |

• Confidence: 91% confidence
• Finding: The skill explicitly references .env-based cookie configuration and, elsewhere in the document, environment variables such as XIANYU_COOKIE_* and COOKIE_ENCRYPTION_KEY. This indicates direct handling of sensitive credentials in environment files, which is dangerous because .env files are frequently overexposed through logs, backups, shell history, misconfigured repositories, or overbroad file access within automation.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

Detected: suspicious.env_credential_access

Python code POSTs credential environment variables to an environment-controlled URL.

Critical

• Code: suspicious.env_credential_access
• Location: scripts/cookie_keeper.py:615