DataHive Installer

• Outcome: Review
• Latest audit: Sep 11, 2026 · 10:58 AM UTC
• Version: 0.1.0

Overview

This skill performs the advertised DataHive login flow, but it also makes persistent, privileged browser changes and handles login tokens in ways that need careful review.

Install only if you are comfortable granting this skill administrative installation authority, persistent Chrome control, Gmail lookup access, and managed browser-policy changes. Prefer a version that avoids forced extensions, validates URLs, redacts magic links, keeps Chrome sandboxed, and includes cleanup or rollback steps.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (7)

T03 · Remote Payload Retrieval and Execution

Error

• Location: scripts/1_install_prerequisites.sh:49
• Finding: Persistent Force-Installation of a Remotely Mutable Chrome Extension<![CDATA[ ## Vulnerability Details **File Location**: `scripts/1_install_prerequisites.sh:7, 49-57, 77-86` **Vulnerability Type**: Persistent browser policy modification and remote code retrieval **Risk Level**: High ### Vulnerable Code ```bash EXTENSION_ID="bonfdkhbkkdoipfojcnimjagphdnfedb" ``` ```bash echo "==> [ubuntu] Force-installing DataHive extension via Chrome policy..." sudo mkdir -p /etc/opt/chrome/policies/managed sudo tee /etc/opt/chrome/policies/managed/extensions.json > /dev/null << EOF { "ExtensionInstallForcelist": [ "${EXTENSION_ID};https://clients2.google.com/service/update2/crx" ] } EOF ``` ```bash echo "==> [macos] Applying managed extension policy (requires sudo)..." POLICY_DIR="/Library/Managed Preferences" POLICY_FILE="$POLICY_DIR/com.google.Chrome.plist" POLICY_VALUE="${EXTENSION_ID};https://clients2.google.com/service/update2/crx" sudo mkdir -p "$POLICY_DIR" sudo /usr/libexec/PlistBuddy -c "Delete :ExtensionInstallForcelist" "$POLICY_FILE" 2>/dev/null || true sudo /usr/libexec/PlistBuddy -c "Add :ExtensionInstallForcelist array" "$POLICY_FILE" sudo /usr/libexec/PlistBuddy -c "Add :ExtensionInstallForcelist:0 string $POLICY_VALUE" "$POLICY_FILE" sudo plutil -lint "$POLICY_FILE" >/dev/null ``` ### Technical Analysis The installer uses administrator privileges to create a managed Chrome policy that force-installs extension `bonfdkhbkkdoipfojcnimjagphdnfedb`. The extension is downloaded from an external update service, but its source code, permissions, version, and integrity metadata are absent from the audited project. Consequently, the effective browser code can change after this Skill has been reviewed. Managed force-installed extensions generally cannot be disabled by an ordinary user and remain installed across browser and system sessions. The documented magic-link workflow only requires an HTTP request, email retrieval, and CDP navigation; it does not establish why a system-wide forced extension is necessary. On macOS, ...[truncated 1381 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove the managed extension installation unless the extension is essential to the declared authentication workflow. 2. If it is essential, document its exact purpose, requested permissions, publisher, and data-handling behavior. 3. Make the extension source available for review and pin a specific version or cryptographically verified artifact. 4. Obtain explicit operator consent before changing managed browser policy. 5. Do not delete the existing `ExtensionInstallForcelist`; merge changes safely and preserve administrator configuration. 6. Prefer a user-scoped, isolated Chrome profile rather than system-wide managed policy. 7. Add an uninstall or cleanup procedure that restores the previous policy exactly. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/2_launch_chrome_supervisor.sh:76
• Finding: Arbitrary Shell Command Execution Through eval and Environment-Controlled Paths<![CDATA[ ## Vulnerability Details **File Location**: `scripts/2_launch_chrome_supervisor.sh:6-9, 76-92` **Vulnerability Type**: Shell command injection **Risk Level**: High ### Vulnerable Code ```bash PROFILE_DIR="${PROFILE_DIR:-$HOME/.chrome-datahive}" LOG_FILE="${LOG_FILE:-$PROFILE_DIR/chrome.log}" PID_FILE="${PID_FILE:-$PROFILE_DIR/chrome.pid}" ``` ```bash if [[ "$PLATFORM" == "ubuntu" ]]; then CHROME_CMD="xvfb-run -a google-chrome --no-sandbox --disable-gpu --disable-dev-shm-usage --no-first-run --disable-default-apps $HEADLESS_FLAG --remote-debugging-port=9222 --user-data-dir=\"$PROFILE_DIR\" --profile-directory=datahive" elif [[ "$PLATFORM" == "macos" ]]; then CHROME_BIN="/Applications/Google Chrome.app/Contents/MacOS/Google Chrome" if [[ ! -x "$CHROME_BIN" ]]; then echo "Error: Chrome binary not found at $CHROME_BIN" >&2 exit 1 fi CHROME_CMD="\"$CHROME_BIN\" --no-first-run --disable-default-apps --disable-gpu $NO_SANDBOX_FLAG $HEADLESS_FLAG --remote-debugging-port=9222 --user-data-dir=\"$PROFILE_DIR\" --profile-directory=datahive" fi SUPERVISOR_SCRIPT='set -u while true; do eval "$CHROME_CMD" ``` ### Technical Analysis The script constructs a shell command as a string and executes it with `eval`. `PROFILE_DIR` is accepted from the process environment and interpolated into that command string. Although the value is surrounded by literal double quotes, a crafted value can include a double quote followed by shell syntax, terminate the intended argument, and introduce additional commands. Using `eval` causes the shell to parse the generated content a second time. This converts data originating from environment variables into executable shell syntax. ### Attack Path 1. An attacker gains influence over the environment used to invoke the Skill, including `PROFILE_DIR`. 2. The attacker supplies a value containing quote characters and shell metacharacters. 3. The script embeds the value into `CHROME_CMD`. 4. The supervisor invokes `e ...[truncated 767 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove `eval` entirely. 2. Build the Chrome invocation as a Bash array: ```bash chrome_cmd=( xvfb-run -a google-chrome --disable-gpu --disable-dev-shm-usage --no-first-run --disable-default-apps --remote-debugging-address=127.0.0.1 --remote-debugging-port=9222 "--user-data-dir=$PROFILE_DIR" --profile-directory=datahive ) "${chrome_cmd[@]}" ``` 3. Append optional flags as individual array elements rather than interpolated strings. 4. Validate that configurable paths are absolute, contain no control characters, and resolve beneath an expected user-owned directory. 5. Avoid passing a serialized command through an environment variable to a second shell. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/2_launch_chrome_supervisor.sh:75
• Finding: Chrome Sandbox Disabled Unconditionally on Ubuntu<![CDATA[ ## Vulnerability Details **File Location**: `scripts/2_launch_chrome_supervisor.sh:75-77` **Vulnerability Type**: Browser security boundary disabled **Risk Level**: High ### Vulnerable Code ```bash if [[ "$PLATFORM" == "ubuntu" ]]; then CHROME_CMD="xvfb-run -a google-chrome --no-sandbox --disable-gpu --disable-dev-shm-usage --no-first-run --disable-default-apps $HEADLESS_FLAG --remote-debugging-port=9222 --user-data-dir=\"$PROFILE_DIR\" --profile-directory=datahive" ``` ### Technical Analysis The Ubuntu launch command always passes `--no-sandbox`. Chrome's sandbox is a major defense-in-depth boundary intended to contain compromised renderer and browser-related processes. Disabling it is not necessary for the declared magic-link navigation workflow and significantly increases the consequences of a browser vulnerability, malicious web content, or compromised extension. This exposure is amplified by the separate forced installation of an externally maintained extension. ### Attack Path 1. The Skill starts Chrome on Ubuntu with `--no-sandbox`. 2. Chrome loads the DataHive authentication page and the force-installed extension. 3. A malicious page, compromised dependency, or vulnerable browser component executes attacker-controlled browser code. 4. The normal Chrome sandbox is unavailable to contain that code. 5. Exploitation can reach resources accessible to the user running Chrome more directly than in a normally sandboxed deployment. ### Impact Assessment This setting does not itself execute attacker code, but it removes a critical containment mechanism. If Chrome, a renderer, or an extension is compromised, the attacker may obtain access to files, browser profile data, tokens, and other resources belonging to the invoking user. The exposure applies to every page processed by this persistent Chrome instance, not only the single DataHive login URL. ]]>
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove `--no-sandbox` from the Ubuntu command. 2. Configure the environment so Chrome's standard user-namespace or setuid sandbox operates correctly. 3. Fail safely with a clear error if the sandbox cannot initialize instead of silently disabling it. 4. Run Chrome as a dedicated unprivileged user with a minimal, isolated profile. 5. Keep the browser and its dependencies patched and avoid loading unnecessary extensions. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/6_open_magic_link.sh:3
• Finding: Magic Authentication Token Disclosed in Process Environment and Output<![CDATA[ ## Vulnerability Details **File Location**: `scripts/6_open_magic_link.sh:3-4, 17-20` **Vulnerability Type**: Sensitive authentication URL disclosure **Risk Level**: Medium ### Vulnerable Code ```bash CDP_URL="${CDP_URL:-http://localhost:9222}" TARGET_URL="${TARGET_URL:?TARGET_URL env variable is required}" ``` ```bash RESPONSE=$(websocat -n1 "$WS_URL" <<< "{\"id\":1,\"method\":\"Page.navigate\",\"params\":{\"url\":\"$TARGET_URL\"}}") echo "$RESPONSE" echo "Opened $TARGET_URL" ``` The documented invocation also exposes the token through an environment assignment: ```bash TARGET_URL='https://dashboard.datahive.ai/auth?token=<TOKEN>' ./scripts/6_open_magic_link.sh ``` ### Technical Analysis The complete magic-link URL contains a short-lived bearer-style authentication token. The helper requires that URL in an environment variable and then prints it verbatim. The token can consequently enter terminal history, agent transcripts, CI logs, process diagnostics, monitoring output, or other command-output capture systems. Although the documentation warns that magic links are secrets, the implementation contradicts that guidance by logging the secret. ### Attack Path 1. The Skill retrieves a valid DataHive magic link from Gmail. 2. The complete URL is assigned to `TARGET_URL`. 3. The helper navigates Chrome to the URL. 4. The helper prints `Opened <complete URL>`, including the token. 5. An observer with access to the transcript, terminal output, or captured logs retrieves the link. 6. The observer opens the link before expiration and attempts to authenticate as the intended user. ### Impact Assessment Disclosure can permit unauthorized DataHive authentication during the link's validity period, documented as approximately 15 minutes. The resulting account privileges are those granted by DataHive to the affected email account. The exposure is limited by token expiration and any server-side one-time-use enforcement, but neither should be relied upon ...[truncated 45 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Never print the complete target URL or query string. 2. Log only a fixed message such as `Opened validated DataHive authentication URL`. 3. Pass the secret through protected standard input or a temporary file with mode `0600`, deleting it immediately after use. 4. If an environment variable must be used, unset it as soon as the value is consumed. 5. Ensure command tracing is disabled and redact magic-link tokens from agent, CI, and application logs. 6. Prefer server-side one-time-use tokens with short expiration and immediate invalidation after successful navigation. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/6_open_magic_link.sh:3
• Finding: Unvalidated CDP and Navigation URLs with Unsafe JSON Construction<![CDATA[ ## Vulnerability Details **File Location**: `scripts/6_open_magic_link.sh:3-17` **Vulnerability Type**: Unrestricted URL handling and JSON injection **Risk Level**: Medium ### Vulnerable Code ```bash CDP_URL="${CDP_URL:-http://localhost:9222}" TARGET_URL="${TARGET_URL:?TARGET_URL env variable is required}" curl -sf "$CDP_URL/json/version" >/dev/null || { echo "Error: Chrome DevTools endpoint is unavailable at $CDP_URL (is Chrome running with --remote-debugging-port=9222?)" >&2 exit 1 } NEW_TAB=$(curl -sf -X PUT "$CDP_URL/json/new") || { echo "Error: failed to create tab at $CDP_URL" >&2 exit 1 } WS_URL=$(echo "$NEW_TAB" | grep '"webSocketDebuggerUrl"' | cut -d'"' -f4) RESPONSE=$(websocat -n1 "$WS_URL" <<< "{\"id\":1,\"method\":\"Page.navigate\",\"params\":{\"url\":\"$TARGET_URL\"}}") ``` ### Technical Analysis The script does not verify that `TARGET_URL` uses HTTPS, belongs to `dashboard.datahive.ai`, and targets the expected `/auth` route. It will attempt to navigate to any value provided through the environment. The value is also inserted directly into a JSON string without JSON escaping. Quotes, backslashes, or control characters can make the message malformed or alter its structure. Similarly, `CDP_URL` is environment-controlled and is not restricted to a loopback endpoint. The helper can therefore send HTTP requests to an arbitrary host and connect to a WebSocket URL returned by that host. ### Attack Path 1. An attacker influences the extracted URL or the environment supplied to the helper. 2. The attacker sets `TARGET_URL` to an unintended destination or includes JSON metacharacters. 3. The helper creates a new browser tab and sends the constructed CDP message. 4. Chrome navigates to an attacker-selected URL, or the crafted value changes the CDP request structure. 5. Alternatively, the attacker changes `CDP_URL` to an external service. 6. The helper contacts that service and trusts its returned `webSocketDebuggerUrl`. 7. The at ...[truncated 602 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Parse and validate `TARGET_URL` before navigation. 2. Require: - Scheme: `https` - Host: exactly `dashboard.datahive.ai` - Path: exactly the expected authentication route - No user-information component - No unexpected port 3. Restrict `CDP_URL` to a fixed loopback address such as `http://127.0.0.1:9222`. 4. Validate that `webSocketDebuggerUrl` also resolves to the expected loopback CDP service. 5. Generate the protocol request with a JSON encoder: ```bash payload=$(jq -cn --arg url "$TARGET_URL" \ '{id:1, method:"Page.navigate", params:{url:$url}}') websocat -n1 "$WS_URL" <<< "$payload" ``` 6. Parse the CDP response with `jq` instead of `grep` and `cut`. ]]>

T09 · Insecure Skill Coding Practices

Note

• Location: scripts/4_request_magic_link.sh:4
• Finding: Email Address Embedded in JSON Without Validation or Escaping<![CDATA[ ## Vulnerability Details **File Location**: `scripts/4_request_magic_link.sh:4-9` **Vulnerability Type**: JSON injection and malformed request construction **Risk Level**: Low ### Vulnerable Code ```bash EMAIL="${1:-${EMAIL:-}}" [[ -n "$EMAIL" ]] || { echo "Usage: $0 <email> (or set EMAIL=...)" >&2; exit 1; } curl -sS 'https://api.datahive.ai/api/auth/magic-link/request' \ -H 'content-type: application/json' \ --data-raw "{\"email\":\"$EMAIL\",\"redirectUrl\":\"https://dashboard.datahive.ai/auth\"}" ``` ### Technical Analysis The email value is directly interpolated into a JSON string. The script only checks that it is nonempty. A value containing a double quote, backslash, newline, or other JSON metacharacter can invalidate the body or introduce additional JSON fields. Normal email addresses obtained from a trusted `gog` account are unlikely to contain such syntax. Nevertheless, the helper also accepts an arbitrary command-line argument or environment variable, so it should treat the value as untrusted data. Transmission of the email to `https://api.datahive.ai` is disclosed by the Skill and is functionally necessary to request the magic link; the vulnerability is the unsafe encoding, not the declared transmission itself. ### Attack Path 1. An attacker or calling process controls the argument or `EMAIL` environment variable. 2. A crafted value containing JSON syntax is supplied. 3. The helper interpolates it into the request body without escaping. 4. DataHive receives malformed JSON or a request whose object structure differs from the intended structure. 5. Depending on server validation, this may cause request failure or manipulation of accepted request fields. ### Impact Assessment The likely impact is denial of the login request or incorrect request semantics. If the server accepts attacker-introduced fields, request behavior could potentially be modified within the constraints of the endpoint. There is no evidence in the audited co ...[truncated 90 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Validate that the input conforms to the expected email-address format and reject control characters. 2. Use a JSON encoder instead of string interpolation: ```bash payload=$(jq -cn \ --arg email "$EMAIL" \ --arg redirectUrl "https://dashboard.datahive.ai/auth" \ '{email:$email, redirectUrl:$redirectUrl}') curl --fail-with-body --silent --show-error \ 'https://api.datahive.ai/api/auth/magic-link/request' \ -H 'content-type: application/json' \ --data-binary "$payload" ``` 3. Check the HTTP status and validate the response schema before continuing. ]]>

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: scripts/1_install_prerequisites.sh:74
• Finding: Recursive Removal of macOS Quarantine Metadata from Chrome<![CDATA[ ## Vulnerability Details **File Location**: `scripts/1_install_prerequisites.sh:74-75` **Vulnerability Type**: Platform security-control bypass **Risk Level**: Medium ### Vulnerable Code ```bash echo "==> [macos] Removing quarantine attribute from Google Chrome (if present)..." xattr -dr com.apple.quarantine "/Applications/Google Chrome.app" 2>/dev/null || true ``` ### Technical Analysis The script recursively removes the `com.apple.quarantine` extended attribute from the complete Chrome application bundle. Quarantine metadata participates in macOS Gatekeeper checks and user-facing trust decisions for downloaded software. The command is executed without confirming the bundle's provenance, code signature, notarization state, or installation source. Removing quarantine is not required by the declared DataHive magic-link workflow and suppresses errors through `|| true`, preventing the operator from seeing whether this security-sensitive operation failed. ### Attack Path 1. A Chrome bundle exists at the expected path, but it has been replaced, modified, or downloaded from an untrusted source. 2. The operator runs the prerequisite script. 3. The script recursively removes quarantine metadata from that bundle. 4. The later supervisor starts the application. 5. Security prompts or checks associated with quarantine metadata may no longer occur as expected. 6. A tampered application can execute with the privileges of the user launching Chrome. ### Impact Assessment This weakens a macOS security control for the entire Chrome bundle. If the application has been tampered with, execution could compromise all data and resources accessible to the invoking user, including the isolated browser profile and magic-link authentication token. The command does not itself modify code signatures or automatically grant root privileges, but it unnecessarily reduces protection against untrusted application bundles. ]]>
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove the recursive `xattr` command. 2. Install Chrome only through a trusted, signed, and notarized distribution channel. 3. Verify the application before launch using macOS facilities such as: ```bash codesign --verify --deep --strict "/Applications/Google Chrome.app" spctl --assess --type execute "/Applications/Google Chrome.app" ``` 4. If platform validation fails, stop and report the failure instead of bypassing it. 5. Do not suppress security-relevant errors with `|| true`. ]]>

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Rogue Agent: Self-Modification, Session Persistence
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (47)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: The skill is advertised as DataHive-specific login automation, but parts of the behavior are generic URL opening and browser control without clear verification that only trusted DataHive endpoints are used. Generic browser automation combined with token-bearing URLs can be abused to open attacker-controlled links or mishandle secrets.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: The skill is advertised as DataHive-specific login automation, but parts of the behavior are generic URL opening and browser control without clear verification that only trusted DataHive endpoints are used. Generic browser automation combined with token-bearing URLs can be abused to open attacker-controlled links or mishandle secrets.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: The skill is advertised as DataHive-specific login automation, but parts of the behavior are generic URL opening and browser control without clear verification that only trusted DataHive endpoints are used. Generic browser automation combined with token-bearing URLs can be abused to open attacker-controlled links or mishandle secrets.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: The skill is advertised as DataHive-specific login automation, but parts of the behavior are generic URL opening and browser control without clear verification that only trusted DataHive endpoints are used. Generic browser automation combined with token-bearing URLs can be abused to open attacker-controlled links or mishandle secrets.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: The skill is advertised as DataHive-specific login automation, but parts of the behavior are generic URL opening and browser control without clear verification that only trusted DataHive endpoints are used. Generic browser automation combined with token-bearing URLs can be abused to open attacker-controlled links or mishandle secrets.

Ae1

High

• Category: analysis-evasion

Content

Always execute this skill in the exact sequence defined in **strict order**, exactly as written in this `SKILL.md`.

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Credential Access

High

• Category: Privilege Escalation

Content

echo "==> [ubuntu] Installing Google Chrome + runtime deps..."
  sudo apt-get update
  sudo apt-get install -y --no-install-recommends wget gnupg2 xvfb
  wget -qO- https://dl.google.com/linux/linux_signing_key.pub | sudo gpg --dearmor -o /usr/share/keyrings/google-chrome.gpg
  echo "deb [arch=amd64 signed-by=/usr/share/keyrings/google-chrome.gpg] http://dl.google.com/linux/chrome/deb/ stable main" | \
    sudo tee /etc/apt/sources.list.d/google-chrome.list > /dev/null
  sudo apt-get update

• Confidence: 70% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

echo "==> [ubuntu] Installing Google Chrome + runtime deps..."
  sudo apt-get update
  sudo apt-get install -y --no-install-recommends wget gnupg2 xvfb
  wget -qO- https://dl.google.com/linux/linux_signing_key.pub | sudo gpg --dearmor -o /usr/share/keyrings/google-chrome.gpg
  echo "deb [arch=amd64 signed-by=/usr/share/keyrings/google-chrome.gpg] http://dl.google.com/linux/chrome/deb/ stable main" | \
    sudo tee /etc/apt/sources.list.d/google-chrome.list > /dev/null
  sudo apt-get update

• Confidence: 70% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Chaining Abuse

High

• Category: Tool Misuse

Content

echo "==> [ubuntu] Installing Google Chrome + runtime deps..."
  sudo apt-get update
  sudo apt-get install -y --no-install-recommends wget gnupg2 xvfb
  wget -qO- https://dl.google.com/linux/linux_signing_key.pub | sudo gpg --dearmor -o /usr/share/keyrings/google-chrome.gpg
  echo "deb [arch=amd64 signed-by=/usr/share/keyrings/google-chrome.gpg] http://dl.google.com/linux/chrome/deb/ stable main" | \
    sudo tee /etc/apt/sources.list.d/google-chrome.list > /dev/null
  sudo apt-get update

• Confidence: 75% confidence
• Finding: Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

sudo tee /etc/apt/sources.list.d/google-chrome.list > /dev/null
  sudo apt-get update
  sudo apt-get install -y --no-install-recommends google-chrome-stable
  sudo rm -rf /var/lib/apt/lists/*

  echo "==> [ubuntu] Force-installing DataHive extension via Chrome policy..."
  sudo mkdir -p /etc/opt/chrome/policies/managed

• Confidence: 100% confidence
• Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

sudo tee /etc/apt/sources.list.d/google-chrome.list > /dev/null
  sudo apt-get update
  sudo apt-get install -y --no-install-recommends google-chrome-stable
  sudo rm -rf /var/lib/apt/lists/*

  echo "==> [ubuntu] Force-installing DataHive extension via Chrome policy..."
  sudo mkdir -p /etc/opt/chrome/policies/managed

• Confidence: 100% confidence
• Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 90% confidence
• Finding: The skill invokes shell commands, package installation, browser launch, Gmail access, and CDP interactions but declares no explicit tool scope or permission boundaries. That makes the effective authority of the skill opaque and increases the chance an agent executes high-risk actions without informed consent or policy enforcement.

Description-Behavior Mismatch

Medium

• Confidence: 96% confidence
• Finding: The manifest frames the skill as sign-in automation, but the body instructs installation of system packages and browser policy changes. This scope drift is dangerous because it weakens informed consent and can conceal invasive persistence or policy modifications behind a benign description.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The skill instructs searching and retrieving Gmail messages through gog but does not present an explicit up-front warning that it will access mailbox content. Email contains highly sensitive data, and magic-link workflows expose authentication tokens that should only be handled with informed user consent and minimal retention.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill does not clearly warn users that it will install software and write managed Chrome policy settings, including privileged system locations. Silent host modification is risky because it can change browser behavior persistently and create administrative trust anchors without the operator's informed approval.

Intent-Code Divergence

Medium

• Confidence: 93% confidence
• Finding: The inline text explicitly says the skill is limited to authentication automation, yet the steps include host installation and configuration. Contradictory safety framing can cause users or orchestrators to trust the skill more than warranted and execute privileged changes without scrutiny.

Session Persistence

Medium

• Category: Rogue Agent

Content

Behavior by platform:
- `ubuntu`: installs Chrome + xvfb via `apt`, applies managed extension policy, installs `websocat`.
- `macos`: installs Chrome via Homebrew cask (if missing), applies managed extension policy in `/Library/Managed Preferences/com.google.Chrome.plist`, installs `websocat`.

## Step 2 — Launch browser in persistent background mode (platform-aware)

• Confidence: 86% confidence
• Finding: The skill describes persistent background browser operation and managed policy configuration, which creates session persistence beyond the immediate task. Persistent authenticated browser state and always-on CDP access increase the window for token theft, unauthorized browser control, and cross-session abuse.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

install_ubuntu() {
  echo "==> [ubuntu] Installing Google Chrome + runtime deps..."
  sudo apt-get update
  sudo apt-get install -y --no-install-recommends wget gnupg2 xvfb
  wget -qO- https://dl.google.com/linux/linux_signing_key.pub | sudo gpg --dearmor -o /usr/share/keyrings/google-chrome.gpg
  echo "deb [arch=amd64 signed-by=/usr/share/keyrings/google-chrome.gpg] http://dl.google.com/linux/chrome/deb/ stable main" | \

• Confidence: 70% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

install_ubuntu() {
  echo "==> [ubuntu] Installing Google Chrome + runtime deps..."
  sudo apt-get update
  sudo apt-get install -y --no-install-recommends wget gnupg2 xvfb
  wget -qO- https://dl.google.com/linux/linux_signing_key.pub | sudo gpg --dearmor -o /usr/share/keyrings/google-chrome.gpg
  echo "deb [arch=amd64 signed-by=/usr/share/keyrings/google-chrome.gpg] http://dl.google.com/linux/chrome/deb/ stable main" | \

• Confidence: 70% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

install_ubuntu() {
  echo "==> [ubuntu] Installing Google Chrome + runtime deps..."
  sudo apt-get update
  sudo apt-get install -y --no-install-recommends wget gnupg2 xvfb
  wget -qO- https://dl.google.com/linux/linux_signing_key.pub | sudo gpg --dearmor -o /usr/share/keyrings/google-chrome.gpg
  echo "deb [arch=amd64 signed-by=/usr/share/keyrings/google-chrome.gpg] http://dl.google.com/linux/chrome/deb/ stable main" | \

• Confidence: 70% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

install_ubuntu() {
  echo "==> [ubuntu] Installing Google Chrome + runtime deps..."
  sudo apt-get update
  sudo apt-get install -y --no-install-recommends wget gnupg2 xvfb
  wget -qO- https://dl.google.com/linux/linux_signing_key.pub | sudo gpg --dearmor -o /usr/share/keyrings/google-chrome.gpg
  echo "deb [arch=amd64 signed-by=/usr/share/keyrings/google-chrome.gpg] http://dl.google.com/linux/chrome/deb/ stable main" | \

• Confidence: 70% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

install_ubuntu() {
  echo "==> [ubuntu] Installing Google Chrome + runtime deps..."
  sudo apt-get update
  sudo apt-get install -y --no-install-recommends wget gnupg2 xvfb
  wget -qO- https://dl.google.com/linux/linux_signing_key.pub | sudo gpg --dearmor -o /usr/share/keyrings/google-chrome.gpg
  echo "deb [arch=amd64 signed-by=/usr/share/keyrings/google-chrome.gpg] http://dl.google.com/linux/chrome/deb/ stable main" | \

• Confidence: 70% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

install_ubuntu() {
  echo "==> [ubuntu] Installing Google Chrome + runtime deps..."
  sudo apt-get update
  sudo apt-get install -y --no-install-recommends wget gnupg2 xvfb
  wget -qO- https://dl.google.com/linux/linux_signing_key.pub | sudo gpg --dearmor -o /usr/share/keyrings/google-chrome.gpg
  echo "deb [arch=amd64 signed-by=/usr/share/keyrings/google-chrome.gpg] http://dl.google.com/linux/chrome/deb/ stable main" | \

• Confidence: 70% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

install_ubuntu() {
  echo "==> [ubuntu] Installing Google Chrome + runtime deps..."
  sudo apt-get update
  sudo apt-get install -y --no-install-recommends wget gnupg2 xvfb
  wget -qO- https://dl.google.com/linux/linux_signing_key.pub | sudo gpg --dearmor -o /usr/share/keyrings/google-chrome.gpg
  echo "deb [arch=amd64 signed-by=/usr/share/keyrings/google-chrome.gpg] http://dl.google.com/linux/chrome/deb/ stable main" | \

• Confidence: 70% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

install_ubuntu() {
  echo "==> [ubuntu] Installing Google Chrome + runtime deps..."
  sudo apt-get update
  sudo apt-get install -y --no-install-recommends wget gnupg2 xvfb
  wget -qO- https://dl.google.com/linux/linux_signing_key.pub | sudo gpg --dearmor -o /usr/share/keyrings/google-chrome.gpg
  echo "deb [arch=amd64 signed-by=/usr/share/keyrings/google-chrome.gpg] http://dl.google.com/linux/chrome/deb/ stable main" | \

• Confidence: 70% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Static analysis

No suspicious patterns detected.