T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
SKILL.md:22- Finding
Excessive Filesystem and Command-Execution Privileges
- Content
View full analysis
- Remediation
View remediation
Security audit
免费版Google搜索浏览器
Security checks for vulnerabilities and agentic risk
Overview
This Google-search skill has no embedded malware, but it asks for broad local file and command execution authority that is poorly scoped for a search helper.
Install only if you are comfortable granting the hosting agent local file-inspection and command-execution tools for this skill. Prefer running it in a sandboxed, unprivileged environment, and do not provide API keys, credentials, browser profiles, or administrator privileges unless the publisher supplies a clear implementation and command allowlist.
Vulnerability Patterns
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
Vulnerability Patterns
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (7)
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The description says to use the skill for broad needs like SEO optimization, keyword analysis, ranking improvement, and workflow scenarios, but it does not define precise trigger phrases, constraints, or negative examples. This makes the invocation scope too expansive for a manifest/markdown skill description.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill is presented as a Google search utility, yet the manifest grants broad exec access alongside file and search tools. For a narrowly scoped search skill, this is excessive capability and increases the chance of command execution abuse, privilege misuse, or repurposing beyond the stated function.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
The skill describes Google scraping via browser automation while simultaneously asserting that the free version does not support anti-bot bypass. That mismatch is risky because it downplays the operational and policy risks of an automation workflow that is inherently adjacent to anti-detection behavior and may mislead users or reviewers about what the skill actually does.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The activation guidance says only "Invoke when u" followed by "free", which does not define a specific trigger phrase or clear activation boundary. This ambiguity could cause unintended invocation because users and agents cannot tell when the skill should or should not be selected.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The file claims command execution is limited to whitelisted commands and avoids concatenating user input, but it provides no actual whitelist or enforcement details while advertising exec capability. This is dangerous because readers may assume strong controls exist when the documented interface still exposes a path to arbitrary or loosely constrained command execution.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The text states "支持中文交互" while the document otherwise mixes languages and does not clearly offer a language choice or explain a justified locale restriction. Per policy, language or locale constraints should be optional or clearly documented as region-specific.
- Content
Context-Inappropriate Capability
Low
- Category
- Not specified by scanner
- Confidence
- 86% confidence
- Finding
The core description focuses on Google search result extraction, but the major-features section expands the scope to general file processing and external API integration. Those capabilities are not obviously necessary to perform search-result retrieval and therefore appear unjustified relative to the stated purpose.
- Content
Static analysis
No suspicious patterns detected.