Form Auto

• Outcome: Review
• Latest audit: Sep 15, 2026 · 12:40 AM UTC
• Version: 1.0.0

Overview

This form autofill skill is mostly purpose-aligned, but it can expose sensitive browser form values in logs while using an authenticated browser session.

Use this only on trusted sites and avoid pages that may contain passwords, tokens, payment data, or hidden sensitive fields. Review console or agent output carefully because form values may be printed in cleartext. Do not use saved templates for highly sensitive identity data unless you know where they are stored and how to delete them.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:227

Finding

Sensitive Form Values Exposed Through Unrestricted Summary Logging

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 227–244
Vulnerability Type: Sensitive data exposure through insecure logging
Risk Level: Medium

Vulnerable Code

javascript

// Show filled form summary to user
const summary = await browser.evaluate(() => {
  const filled = []
  document.querySelectorAll('input, select, textarea').forEach(el => {
    if (el.value) {
      filled.push({
        label: el.placeholder || el.name || el.id,
        value: el.value
      })
    }
  })
  return filled
})

// Ask user to confirm
console.log("已填写的字段:")
summary.forEach(item => {
  console.log(`  ${item.label}: ${item.value}`)
})

Technical Analysis

The summary logic enumerates every populated input, select, and textarea on the page and returns its raw value from the browser context. It does not limit collection to controls filled by the skill and does not exclude sensitive control types such as password or hidden.

Consequently, the code may collect pre-existing credentials, anti-CSRF tokens, application secrets, identity information, and other values that were populated by the website, password manager, browser profile, or user. These values are then printed without masking, potentially placing them in agent output, browser automation logs, conversation history, or other retained telemetry.

This is an insecure coding practice rather than evidence of intentional exfiltration. No external transmission mechanism was identified in the audited files.

Attack Path

1. A user invokes the skill on a web form while using an existing authenticated browser session.
2. The page contains a populated sensitive control, such as a password field or hidden token. The value may originate from the site, a password manager, or prior user interaction.
3. The summary routine executes document.querySelectorAll('input, select, textarea').
4. Because the sensitive control has a ...[truncated 1001 chars]

Remediation

View remediation

Remediation Suggestions

1. Maintain an explicit list of controls successfully modified by the skill and summarize only those controls.
2. Exclude sensitive types, including password, hidden, file, and payment-related fields.
3. Reject fields whose names, IDs, labels, or autocomplete attributes indicate secrets, tokens, credentials, payment data, or government identifiers.
4. Mask values before display, such as partially redacting telephone numbers, email addresses, identity numbers, and addresses.
5. Prefer a field-name-only confirmation summary where displaying the exact value is unnecessary.
6. Avoid writing raw form values to console output or persistent logs.
7. Require explicit confirmation before collecting or displaying highly sensitive information.
8. Add tests demonstrating that pre-existing, hidden, password, token, and unrelated fields never appear in the summary.

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Memory Poisoning: Persistent Context Injection, Context Window Stuffing, Memory Manipulation
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (4)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The trigger phrases are broad enough to match routine requests like filling surveys, applications, or forms, which increases the chance this high-privilege browser automation skill is invoked unintentionally. In context, accidental activation is risky because the skill reads browser session state and can populate arbitrary web forms with sensitive user data.

Content

No source excerpt is available for this finding.

Context Window Stuffing

Medium

• Category: Memory Poisoning
• Confidence: 85% confidence

Finding

Skill attempts to fill the context window with filler content, displacing legitimate instructions and safety constraints. This can degrade agent performance or bypass safety boundaries.

Content

Scanner excerpt · SKILL.md (reported line 135)May include surrounding context.

md

const value = matchFieldToData(field, userData)
    
    if (value) {
      // Fill input/textarea
      if (field.type === 'text' || field.type === 'email' || 
          field.type === 'tel' || field.type === 'textarea') {
        await browser.evaluate((id, name, val) => {

Scope Creep

Low

• Category: Excessive Agency
• Confidence: 70% confidence

Finding

Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.

Content

Scanner excerpt · LICENSE.txt (reported line 12)May include surrounding context.

text

permit persons to whom the Software is furnished to do so.

THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED,
INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR
PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE
FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR
OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill claims all processing is local and presents itself as privacy-conscious, but elsewhere it logs detected form fields and a summary of filled values to the console. Those logs can expose sensitive personal data such as names, phone numbers, email addresses, addresses, and potentially ID-card data to local logs, debugging tools, or any process/operator with console access.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.