邮件摘要免费版

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 10:35 AM UTC
• Version: 1.0.1

Overview

This skill does what it says: it uses browser automation to read a logged-in webmail inbox and create a local daily summary, but users should treat the output as sensitive.

Install only if you are comfortable letting browser-use automate an already logged-in webmail session. Use a dedicated browser profile or test mailbox where possible, store summaries in a controlled directory, review or pin the browser-use dependency before installation, and avoid providing callback_url unless you intentionally want a completion notice or results sent to that endpoint.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:101

Finding

Unpinned Third-Party Browser Automation Dependency

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 101–102
Vulnerability Type: Unpinned third-party dependency installation
Risk Level: Medium

Vulnerable Code

bash

uv pip install browser-use[cli]
browser-use install

The same unpinned installation command is repeated in the error-handling guidance at line 183:

text

uv pip install browser-use[cli]

Technical Analysis

The skill directs users or agents to install the latest available release of the third-party browser-use package and then execute its installation routine. It does not specify an exact reviewed version, require package hashes, use a dependency lockfile, or prescribe artifact integrity verification.

This creates a supply-chain risk because the code ultimately installed and executed can change after the skill itself has been reviewed. The dependency is particularly sensitive in this context: the skill subsequently directs it to reuse a locally authenticated Chrome session and process private mailbox content. A compromised package release, package registry account, distribution artifact, or transitive dependency could therefore execute arbitrary code in the user's environment while operating near authenticated browser data.

The audit found no evidence that the currently named package is malicious. The vulnerability is the unsafe and non-reproducible dependency installation practice.

Attack Path

1. An attacker compromises the package publisher, distribution account, package registry, release process, or a transitive dependency.
2. The attacker publishes a malicious release that still satisfies the unpinned browser-use[cli] requirement.
3. A user or agent follows the documented command and retrieves the malicious release.
4. Package installation hooks, imported package code, or the subsequent browser-use install command executes attacker-controlled code with the invoking user's privileges.
5. During later skill operation, the compromised dependen ...[truncated 837 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin browser-use to an exact version that has been reviewed and tested, for example through a requirements or project configuration file using an exact-version constraint.
2. Generate and commit a lockfile that records all resolved transitive dependency versions.
3. Require cryptographic hashes for downloaded packages and reject artifacts whose hashes do not match approved values.
4. Document the trusted package index and disable untrusted or supplemental indexes to reduce dependency-confusion exposure.
5. Review the behavior and provenance of browser-use install, including any binaries or browser components it downloads.
6. Update dependencies through a controlled review process with security scanning, changelog inspection, and test-environment validation before production use.
7. Run the browser automation in a sandboxed, least-privileged environment with an isolated Chrome profile containing only the account required for the task.
8. Restrict filesystem and environment-variable access where supported, and avoid exposing unrelated credentials to the installation or browser process.
9. Replace the repeated unpinned command at line 183 with the same pinned, integrity-verified installation procedure.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill automates access to live webmail using a real logged-in browser session, extracts inbox contents, and saves screenshots and markdown summaries locally, but the description does not clearly warn users that sensitive mailbox data will be accessed and persisted. This creates a meaningful privacy and data-handling risk because users may invoke the skill without understanding that email metadata and screenshots can contain confidential personal or business information.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The documented callback_url parameter introduces a path for extracted email data or processing results to be sent to an external endpoint, but the skill does not warn users that mailbox-derived data may leave the local environment. Because the skill handles sensitive inbox information, undisclosed transmission to third-party URLs materially increases the risk of data exfiltration, accidental disclosure, or misuse if a malicious or misconfigured endpoint is supplied.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.