邮件摘要

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:56 AM UTC
• Version: 1.0.0

Overview

This email-summary skill is purpose-aligned, but it needs review because it can automate an already logged-in browser, schedule recurring mailbox access, and save mailbox-derived reports or screenshots without enough containment guidance.

Install only after reviewing the risk of letting browser-use control an authenticated browser. Use a dedicated browser profile and mailbox-only account, pin and isolate dependencies, avoid cron or launchd unless you explicitly need recurring execution, add removal and retention rules, store reports and screenshots in a protected location, and assume AI extraction may send selected mailbox information to the configured LLM provider.

A.I.G

Vulnerability Patterns

• System Persistence: Installs backdoors, hooks, services, or scheduled tasks that survive the run
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (3)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:90

Finding

Unpinned Executable Dependency Installation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 90-93
Vulnerability Type: Unpinned third-party executable dependency
Risk Level: Medium

Code Snippet:

bash

uv pip install browser-use[cli]
browser-use install

Technical Analysis

The Skill instructs users to install the latest available release of browser-use[cli] and then execute its component installer. It provides no version constraint, cryptographic hash, lockfile, package-source restriction, or integrity-verification procedure.

The installed package and its transitive dependencies execute with the privileges of the user running the Agent. Because the Skill subsequently gives this dependency control over an authenticated browser, compromise of the package, its publisher account, the package repository, or a transitive dependency could expose substantially more sensitive data than an ordinary command-line dependency.

This finding does not establish that the current browser-use package is malicious. The risk arises from trusting mutable, unpinned supply-chain content.

Attack Path

1. An attacker compromises the package publisher, package repository, or a transitive dependency.
2. The attacker publishes a malicious release that still satisfies the unrestricted installation command.
3. A user follows the Skill instructions and installs the latest package.
4. Malicious installation or runtime code executes under the user's account.
5. When the Skill opens the user's authenticated browser profile, the compromised dependency can potentially access mailbox data, browser session state, API credentials available to the process, and writable local files.

Impact Assessment

Successful exploitation would execute code with the privileges of the user running the Skill. The accessible scope could include:

• Authenticated mailbox contents exposed through the controlled browser.
• Browser session data available to the automation p ...[truncated 319 chars]

Remediation

View remediation

Remediation Suggestions

• Pin browser-use and all transitive dependencies to reviewed versions.
• Maintain a lockfile containing cryptographic hashes.
• Require installation from an explicitly trusted package index.
• Document the expected package publisher and integrity-verification process.
• Review package updates before changing pinned versions.
• Install and run the dependency inside an isolated virtual environment or sandbox.
• Prevent the browser process from inheriting unrelated secrets and environment variables.
• Use a dedicated browser profile containing only the mailbox account required for this task.

T06 · System Persistence

Warning

• Location: SKILL.md:262

Finding

Persistent Unattended Mailbox Automation Through Cron and Launchd

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 262-276
Vulnerability Type: Persistent scheduled execution
Risk Level: Medium

Code Snippet:

bash

crontab -e
0 9 * * * /path/to/email_daily_summary.sh >> /path/to/logs/email_summary.log 2>&1

bash

launchctl load ~/Library/LaunchAgents/com.email.dailysummary.plist

Technical Analysis

The Skill explicitly recommends registering cron or launchd jobs that survive the current Skill invocation and run an email-access script automatically in future sessions. Scheduling is related to the declared daily-summary functionality and is not concealed; therefore, the reviewed instructions do not demonstrate a malicious persistence backdoor.

Nevertheless, persistent scheduling is not required for an on-demand email summary and exceeds the minimum privileges and lifecycle needed for that mode of operation. The instructions do not require an explicit consent checkpoint before registration, do not provide removal commands, and do not define ownership, integrity protection, expiration, execution limits, or least-privilege requirements for the target script.

A scheduled job also creates a durable trust relationship with the script path. If another process or account can modify that script, the generated configuration, or relevant path resolution, the scheduler will repeatedly execute modified content under the scheduling user's identity.

Attack Path

1. A user follows the instructions and registers the email-summary script with cron or launchd.
2. The scheduled entry remains active after the original Agent session ends.
3. An attacker or compromised dependency modifies the referenced script, executable dependency, configuration, or writable report workflow.
4. At the next scheduled time, cron or launchd executes the modified content without a new user approval prompt.
5. The malicious or compromised workflow reuses the authenticated browser se ...[truncated 870 chars]

Remediation

View remediation

Remediation Suggestions

• Keep scheduling disabled by default and require explicit, informed confirmation before creating a job.
• Generate the summary on demand unless the user specifically requests recurring execution.
• Display the exact script path, schedule, browser profile, output path, and data-retention policy before registration.
• Use a dedicated least-privilege operating-system account and browser profile.
• Ensure the scheduled script and parent directories are not writable by other users.
• Use absolute paths for every executable and validate ownership and permissions.
• Provide complete removal instructions, including deleting the cron entry or unloading and deleting the launchd property list.
• Add an expiration date or bounded execution count where possible.
• Restrict report and log permissions to the owning user.
• Record installation status so users can readily identify active scheduled jobs.

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:152

Finding

Broad Access Through Reuse of the Primary Authenticated Browser Session

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 152
Vulnerability Type: Excessive authenticated browser-session exposure
Risk Level: High

Code Snippet:

bash

browser-use --browser real open https://mail.google.com

Technical Analysis

The Skill recommends using --browser real to reuse an existing local Chrome session. This avoids placing a plaintext mailbox password in a script, but it gives the browser-automation dependency access through an already authenticated profile.

A primary browser profile may contain active sessions for the mailbox and unrelated services. The instructions do not enforce a dedicated profile, mailbox-only account, read-only permissions, domain allowlist, or prohibition against state-changing mailbox actions. Consequently, the automation operates with broader effective authority than is necessary to read email metadata and produce a summary.

The project contains no evidence that it intentionally steals browser credentials or accesses unrelated sites. The issue is the unnecessarily broad trust boundary created around the automation dependency.

Attack Path

1. The user has active authenticated sessions in the local Chrome profile.
2. The Skill launches browser-use with access to that real profile.
3. A compromised dependency, maliciously altered workflow, or unsafe browser instruction gains control of the automated browser.
4. The controlled browser operates using the user's existing authenticated identity.
5. It accesses mailbox content or potentially other services available through that profile.
6. Data may then be exposed through generated output, screenshots, logs, or the configured LLM processing path.

The likelihood and scope depend on how browser-use implements real-profile access and what sessions are available in the selected profile.

Impact Assessment

The effective privileges may include:

• Reading email subjects, senders, snippet ...[truncated 608 chars]

Remediation

View remediation

Remediation Suggestions

• Create a dedicated browser profile exclusively for the email-summary workflow.
• Prefer a dedicated mailbox account or delegated read-only access where the provider supports it.
• Restrict navigation to an explicit allowlist of approved mailbox domains.
• Block sending, deleting, forwarding, account-setting changes, and other state-changing actions.
• Require interactive approval before opening message bodies or performing any action beyond metadata extraction.
• Isolate each mailbox account rather than aggregating unrelated sessions in one primary profile.
• Ensure the browser process does not inherit unrelated API keys or system credentials.
• Clearly disclose that LLM-backed extraction may transmit selected mailbox information to the user's configured provider.
• Offer a local-only extraction mode with field-level redaction.
• Apply restrictive permissions and retention limits to reports, screenshots, and logs.

SkillSpector

Vulnerability Patterns

• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• YARA Signatures: Malware Match, Webshell Match, Cryptominer Match
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (10)

YARA rule 'backdoor_persistence': Backdoor persistence with malicious payloads (shell commands, SSH key injection, hidden root users) [malware]

High

• Category: YARA Match
• Confidence: 75% confidence

Finding

YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).

Content

Scanner excerpt · SKILL.md (reported line 97)May include surrounding context.

• 关键词监控:命中白名单发件人或主题关键词时,在日报中高亮并加入"建议操作"区块

前置依赖

1. 安装 browser-use CLI:

bash

uv pip install browser-use[cli]
browser-use install

2. 在本机 Chrome 中至少登录过一次目标邮箱(用于 --browser real 复用会话)
3. 操作系统:Windows / macOS / Linux 均可,定时任务依赖 crontab 或 launchd

支持的邮箱服务

邮箱服务	登录 URL	收件箱 URL
Gmail	https://accounts.google.com	https://mail.google.com
Outlook	https://login.live.com	https://outlook.live.com
QQ 邮箱	https://mail.qq.com	https://mail.qq.com
163 邮箱	https://mail.163.com	https://mail.163.com
126 邮箱	https://mail.126.com	https://mail.126.com
企业微信邮箱	https://exmail.qq.com	https://exmail.qq.com

使用指南

1. 确认 browser-use --version 可正常输出,否则按前置依赖安�

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The description says 'Use when 需要提升效率、自动化流程、批量处理、工作流优化时使用', which is extremely broad and overlaps with many everyday requests unrelated to email summarization. It does not clearly constrain activation to email or inbox-specific tasks, increasing the risk of unintended invocation.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill advertises an automatic anti-bot bypass capability while elsewhere stating CAPTCHA/2FA cannot be bypassed automatically. That contradiction is security-significant because it suggests the tool may be used to evade service protections on webmail providers, increasing the risk of unauthorized access or abuse under the guise of normal automation.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The skill recommends screenshot archiving of inbox contents, which can capture sensitive personal or business information such as sender identities, subjects, previews, and timestamps. Without a prominent privacy warning, retention limits, or access controls, this creates a real risk of local data exposure, oversharing, and compliance violations.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The examples write extracted email summaries and metadata to local Markdown reports without a nearby warning about storing mailbox-derived sensitive information. Even if full bodies are not captured, sender, subject, time, and snippets can contain confidential data and may be exposed through insecure file permissions, backups, or shared workspaces.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 85% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 266)May include surrounding context.

Linux/macOS (crontab)

bash

crontab -e
# 每日 09:00 执行
0 9 * * * /path/to/email_daily_summary.sh >> /path/to/logs/email_summary.log 2>&1

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 75% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 273)May include surrounding context.

macOS (launchd)

创建 ~/Library/LaunchAgents/com.email.dailysummary.plist,设置 StartCalendarInterval 为 Hour=9, Minute=0,ProgramArguments 指向脚本路径,然后:

bash

launchctl load ~/Library/LaunchAgents/com.email.dailysummary.plist

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 75% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 276)May include surrounding context.

macOS (launchd)

创建 ~/Library/LaunchAgents/com.email.dailysummary.plist,设置 StartCalendarInterval 为 Hour=9, Minute=0,ProgramArguments 指向脚本路径,然后:

bash

launchctl load ~/Library/LaunchAgents/com.email.dailysummary.plist

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 75% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 276)May include surrounding context.

创建 ~/Library/LaunchAgents/com.email.dailysummary.plist,设置 StartCalendarInterval 为 Hour=9, Minute=0,ProgramArguments 指向脚本路径,然后:

bash

launchctl load ~/Library/LaunchAgents/com.email.dailysummary.plist

异常响应

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

At L070 the skill is classified as 'MD+EXEC', implying executable command behavior. At L444-L445 it is described as 'MD（纯Markdown指令，通过自然语言驱动Agent完成操作）', which contradicts the earlier execution-oriented classification and the many shell command examples in the file.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.