m44 internal testing

• Outcome: Review
• Latest audit: Sep 10, 2026 · 10:54 PM UTC
• Version: 1.0.0

Overview

This installer appears intended to set up DataHive, but it makes persistent system-wide browser extension changes that are broader than the stated profile-specific setup.

Review this before installing. Running it may require administrator privileges, alter Chrome/Chromium managed policies for the whole machine, persist a forced extension across sessions, and access a mailbox to consume a login magic link. Prefer running only in an isolated environment, require a rollback plan, and do not allow arbitrary extension IDs or environment-controlled WORK_DIR values.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (3)

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: scripts/install_extension_policy.sh:27
• Finding: System-Wide Forced Extension Installation Exceeds the Required Profile Scope<![CDATA[ ## Vulnerability Details **File Location**: `scripts/install_extension_crx.sh:88-100`; `scripts/install_extension_policy.sh:27-38,56-62`; `SKILL.md:36-39` **Vulnerability Type**: Least-privilege violation through system-wide managed browser policies **Risk Level**: High ### Vulnerable Code ```bash # scripts/install_extension_crx.sh:88-100 echo "[4/6] Installing external extension files ($BROWSER)" sudo mkdir -p "$EXT_BASE_DIR" sudo cp "$CRX_PATH" "$EXTERNAL_CRX_PATH" EXT_VERSION="$(python3 - <<PY import json from pathlib import Path m = json.loads(Path('$UNPACK_DIR/manifest.json').read_text()) print(m.get('version','0.0.0')) PY )" printf '{"external_crx":"%s","external_version":"%s"}\n' "$EXTERNAL_CRX_PATH" "$EXT_VERSION" | sudo tee "$EXTERNAL_JSON_PATH" >/dev/null ``` ```bash # scripts/install_extension_policy.sh:27-38 if [ -n "$EXT_ID" ]; then cat <<EOF | ${SUDO} tee "$file" >/dev/null { "ExtensionInstallSources": [ "https://chrome.google.com/*", "https://clients2.google.com/*", "https://chromewebstore.google.com/*" ], "ExtensionInstallForcelist": [ "${EXT_ID};${UPDATE_URL}" ] } EOF ``` ```bash # scripts/install_extension_policy.sh:56-62 # Debian/Ubuntu Google Chrome + Chromium package locations write_policy_file "/etc/opt/chrome/policies/managed" write_policy_file "/etc/chromium/policies/managed" # Chromium Snap common managed policy paths used in many headless/server setups write_policy_file "/var/snap/chromium/current/policies/managed" write_policy_file "/var/snap/chromium/current/chromium-browser/policies/managed" ``` ### Technical Analysis The declared operation is to install DataHive in the dedicated browser profile named `datahive`. The implementation instead requests administrative privileges and writes managed browser policies into four system-level Chrome and Chromium locations. `ExtensionInstallForcelist` instructs supported browsers to install and retain the extension as a managed component. Users may ...[truncated 1798 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Use a user-scoped installation mechanism restricted to the dedicated `datahive` profile. 2. Do not write managed policy unless it is strictly necessary and the user has explicitly consented to a system-wide forced installation. 3. If managed policy is unavoidable: - Write policy only for the browser selected through `BROWSER`. - Do not write policy for both Chrome and Chromium. - Restrict the extension ID to the documented DataHive ID. - Clearly disclose that the extension will be managed and may affect every profile. 4. Add a rollback script that removes: - The installed CRX and external-extension JSON file. - Every policy file created by the installer. 5. Back up pre-existing policy state and restore it during rollback rather than blindly deleting files. 6. Verify effective policy scope after installation and fail if profiles other than `datahive` are affected. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/install_extension_crx.sh:92
• Finding: Python Code Injection Through Environment-Controlled Workspace Path<![CDATA[ ## Vulnerability Details **File Location**: `scripts/install_extension_crx.sh:15-21,92-98` **Vulnerability Type**: Code injection through unsafe heredoc interpolation **Risk Level**: High ### Vulnerable Code ```bash # scripts/install_extension_crx.sh:15-21 EXT_ID="${1:-bonfdkhbkkdoipfojcnimjagphdnfedb}" BROWSER="${BROWSER:-chrome}" PROD_VERSION="${PROD_VERSION:-145.0.7632.109}" WORK_DIR="${WORK_DIR:-/tmp/datahive-crx}" CRX_PATH="$WORK_DIR/${EXT_ID}.crx" ZIP_PATH="$WORK_DIR/${EXT_ID}.zip" UNPACK_DIR="$WORK_DIR/${EXT_ID}-unpacked" ``` ```bash # scripts/install_extension_crx.sh:92-98 EXT_VERSION="$(python3 - <<PY import json from pathlib import Path m = json.loads(Path('$UNPACK_DIR/manifest.json').read_text()) print(m.get('version','0.0.0')) PY )" ``` ### Technical Analysis The heredoc delimiter `PY` is unquoted. Consequently, the shell expands `$UNPACK_DIR` before passing the source code to Python. The expanded value is placed directly inside a single-quoted Python string without escaping. Both `WORK_DIR` and the positional `EXT_ID` argument influence `UNPACK_DIR`. An attacker who can control either value can insert a single quote, terminate the `Path(...)` expression, and append arbitrary Python statements. Shell quoting used by earlier filesystem commands does not prevent this flaw because the vulnerable value is later interpreted as Python source code. A payload can preserve the earlier path operations and use a Python comment to discard the remaining generated source. For example, a path value shaped to produce source conceptually equivalent to the following can execute a local command: ```python m = json.loads(Path('x').read_text()); __import__('os').system('ATTACKER_COMMAND'); # ...remaining text ``` The injected Python runs with the privileges of the user invoking the script. Although this Python block is not itself invoked with `sudo`, the installer is expected to operate in a privileged workflow, making unexpected code execution parti ...[truncated 1338 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions Pass the manifest path as a positional argument instead of interpolating it into Python source: ```bash EXT_VERSION="$( python3 - "$UNPACK_DIR/manifest.json" <<'PY' import json import pathlib import sys manifest_path = pathlib.Path(sys.argv[1]) manifest = json.loads(manifest_path.read_text()) print(manifest.get("version", "0.0.0")) PY )" ``` Additional hardening should include: 1. Quote all heredoc delimiters used for static Python code. 2. Validate `EXT_ID` against the Chrome extension ID format, such as `^[a-p]{32}$`. 3. Prefer rejecting every extension ID other than the documented DataHive ID. 4. Reject workspace paths containing control characters or newline characters. 5. Resolve and validate `WORK_DIR` before use, ensuring it points to an expected user-owned directory. 6. Add automated tests with quotes, newlines, shell metacharacters, and Python syntax in all externally controlled inputs. ]]>

T08 · Insecure Dependencies

Warning

• Location: scripts/install_extension_crx.sh:43
• Finding: Unpinned Remote CRX Is Installed Into Privileged Browser Locations Without Explicit Integrity Verification<![CDATA[ ## Vulnerability Details **File Location**: `scripts/install_extension_crx.sh:43-70,88-100`; `scripts/install_extension_policy.sh:27-37` **Vulnerability Type**: Unsafe remote dependency installation and update configuration **Risk Level**: Medium ### Vulnerable Code ```bash # scripts/install_extension_crx.sh:43-51 CRX_URL="https://clients2.google.com/service/update2/crx?response=redirect&prodversion=${PROD_VERSION}&acceptformat=crx2,crx3&x=id%3D${EXT_ID}%26uc" echo "[1/6] Downloading CRX for extension: $EXT_ID" curl -fL "$CRX_URL" -o "$CRX_PATH" if [[ ! -s "$CRX_PATH" ]]; then echo "ERROR: CRX download failed or returned empty file." >&2 exit 1 fi ``` ```bash # scripts/install_extension_crx.sh:53-70 echo "[2/6] Decoding CRX container" python3 - "$CRX_PATH" "$ZIP_PATH" <<'PY' import pathlib, struct, sys crx_path = pathlib.Path(sys.argv[1]) zip_path = pathlib.Path(sys.argv[2]) data = crx_path.read_bytes() if data[:4] != b"Cr24": raise SystemExit("Not a CRX file") ver = struct.unpack("<I", data[4:8])[0] if ver == 2: pub_len, sig_len = struct.unpack("<II", data[8:16]) off = 16 + pub_len + sig_len elif ver == 3: header_len = struct.unpack("<I", data[8:12])[0] off = 12 + header_len else: raise SystemExit(f"Unsupported CRX version: {ver}") zip_path.write_bytes(data[off:]) print(f"CRX_VERSION={ver}") PY ``` ```bash # scripts/install_extension_crx.sh:88-100 echo "[4/6] Installing external extension files ($BROWSER)" sudo mkdir -p "$EXT_BASE_DIR" sudo cp "$CRX_PATH" "$EXTERNAL_CRX_PATH" EXT_VERSION="$(python3 - <<PY import json from pathlib import Path m = json.loads(Path('$UNPACK_DIR/manifest.json').read_text()) print(m.get('version','0.0.0')) PY )" printf '{"external_crx":"%s","external_version":"%s"}\n' "$EXTERNAL_CRX_PATH" "$EXT_VERSION" | sudo tee "$EXTERNAL_JSON_PATH" >/dev/null ``` ```bash # scripts/install_extension_policy.sh:27-37 if [ -n "$EXT_ID" ]; then cat <<EOF | ${SUDO} tee "$file" >/dev/null { "ExtensionI ...[truncated 3094 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Hard-code or strictly allowlist the DataHive extension ID: `bonfdkhbkkdoipfojcnimjagphdnfedb`. 2. Reject arbitrary extension IDs supplied through positional arguments. 3. Verify the CRX cryptographic signature before privileged installation. 4. Derive the extension ID from the verified signing key and compare it with the expected DataHive ID. 5. Pin an approved extension version and cryptographic digest when deterministic installation is required. 6. Verify the extracted manifest name, version, update URL, and requested permissions against an approved policy. 7. Download into a private directory created with restrictive permissions, such as a `mktemp -d` directory with mode `0700`. 8. Do not install or force-enable the artifact if any integrity or identity check fails. 9. If automatic updates are required, explicitly disclose that the reviewed payload may change and constrain updates to the verified extension identity. 10. Prefer a profile-scoped installation method rather than copying the dependency into a system-wide privileged location. ]]>

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (19)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: The skill claims CRX-only installation and a narrow DataHive-specific flow, yet the underlying behavior reportedly enables broader extension installation paths and arbitrary force-install by extension ID through browser policy. In the context of browser extensions, that is high risk because extensions can access browsing data, inject scripts, and persist across sessions, while the user may believe only a limited one-off setup is occurring.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: The skill claims CRX-only installation and a narrow DataHive-specific flow, yet the underlying behavior reportedly enables broader extension installation paths and arbitrary force-install by extension ID through browser policy. In the context of browser extensions, that is high risk because extensions can access browsing data, inject scripts, and persist across sessions, while the user may believe only a limited one-off setup is occurring.

Credential Access

High

• Category: Privilege Escalation

Content

${SUDO} apt-get update -y
  ${SUDO} apt-get install -y wget gnupg ca-certificates
  wget -qO- https://dl.google.com/linux/linux_signing_key.pub | ${SUDO} gpg --batch --yes --dearmor -o /usr/share/keyrings/google-linux-signing-keyring.gpg
  echo "deb [arch=amd64 signed-by=/usr/share/keyrings/google-linux-signing-keyring.gpg] http://dl.google.com/linux/chrome/deb/ stable main" | ${SUDO} tee /etc/apt/sources.list.d/google-chrome.list >/dev/null
  ${SUDO} apt-get update -y
  ${SUDO} apt-get install -y google-chrome-stable

• Confidence: 70% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

${SUDO} apt-get update -y
  ${SUDO} apt-get install -y wget gnupg ca-certificates
  wget -qO- https://dl.google.com/linux/linux_signing_key.pub | ${SUDO} gpg --batch --yes --dearmor -o /usr/share/keyrings/google-linux-signing-keyring.gpg
  echo "deb [arch=amd64 signed-by=/usr/share/keyrings/google-linux-signing-keyring.gpg] http://dl.google.com/linux/chrome/deb/ stable main" | ${SUDO} tee /etc/apt/sources.list.d/google-chrome.list >/dev/null
  ${SUDO} apt-get update -y
  ${SUDO} apt-get install -y google-chrome-stable

• Confidence: 70% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

# Recover from stale failed install path if present.
  if [ -d /var/snap/chromium/current ] && [ ! -L /var/snap/chromium/current ]; then
    ${SUDO} rm -rf /var/snap/chromium/current || true
  fi

  ${SUDO} snap install chromium

• Confidence: 100% confidence
• Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

# Recover from stale failed install path if present.
  if [ -d /var/snap/chromium/current ] && [ ! -L /var/snap/chromium/current ]; then
    ${SUDO} rm -rf /var/snap/chromium/current || true
  fi

  ${SUDO} snap install chromium

• Confidence: 100% confidence
• Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Chaining Abuse

High

• Category: Tool Misuse

Content

PY
)"

printf '{"external_crx":"%s","external_version":"%s"}\n' "$EXTERNAL_CRX_PATH" "$EXT_VERSION" | sudo tee "$EXTERNAL_JSON_PATH" >/dev/null

echo "[5/6] Verifying installed files"
test -s "$CRX_PATH"

• Confidence: 75% confidence
• Finding: Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.

Description-Behavior Mismatch

High

• Confidence: 97% confidence
• Finding: The script explicitly configures managed browser policies to permit extension installation from Chrome Web Store domains, which contradicts the skill's stated CRX-only installation model. In the context of an installer skill, this broadens the trust boundary from a single intended extension package to any extension obtainable from the allowed sources, enabling unintended or malicious extension installation if the environment or subsequent automation is compromised.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 83% confidence
• Finding: The skill directs use of shell scripts, browser/profile changes, and extension installation, but it declares no explicit tool scope or permission boundaries. That makes powerful file and shell capabilities implicit, reducing transparency and increasing the chance an agent executes privileged or system-changing actions without informed approval.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The skill performs browser profile modification and extension installation without clearly warning that it changes local browser configuration and may persist software in the user's environment. In this context, silent browser modification is risky because it alters a trusted application surface and may introduce persistent code execution through extensions.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The skill instructs the agent to access a mailbox and retrieve a magic-link email without any explicit privacy warning, consent checkpoint, or data-handling limitation. Email access is sensitive because it may expose unrelated messages, authentication links, and account takeover paths beyond the intended DataHive login.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

PY

echo "[4/6] Installing external extension files ($BROWSER)"
sudo mkdir -p "$EXT_BASE_DIR"
sudo cp "$CRX_PATH" "$EXTERNAL_CRX_PATH"

EXT_VERSION="$(python3 - <<PY

• Confidence: 70% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

PY

echo "[4/6] Installing external extension files ($BROWSER)"
sudo mkdir -p "$EXT_BASE_DIR"
sudo cp "$CRX_PATH" "$EXTERNAL_CRX_PATH"

EXT_VERSION="$(python3 - <<PY

• Confidence: 70% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

PY

echo "[4/6] Installing external extension files ($BROWSER)"
sudo mkdir -p "$EXT_BASE_DIR"
sudo cp "$CRX_PATH" "$EXTERNAL_CRX_PATH"

EXT_VERSION="$(python3 - <<PY

• Confidence: 70% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

echo "[4/6] Installing external extension files ($BROWSER)"
sudo mkdir -p "$EXT_BASE_DIR"
sudo cp "$CRX_PATH" "$EXTERNAL_CRX_PATH"

EXT_VERSION="$(python3 - <<PY
import json

• Confidence: 86% confidence
• Finding: This copies a CRX downloaded from the network into a root-controlled browser extension directory, causing privileged installation of code that was not cryptographically validated by the script. Because EXT_ID and PROD_VERSION are externally controllable and the script does not verify the publisher key or expected hash, a compromised download path or misconfiguration could persistently install an unintended extension with broad browser privileges.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

PY
)"

printf '{"external_crx":"%s","external_version":"%s"}\n' "$EXTERNAL_CRX_PATH" "$EXT_VERSION" | sudo tee "$EXTERNAL_JSON_PATH" >/dev/null

echo "[5/6] Verifying installed files"
test -s "$CRX_PATH"

• Confidence: 84% confidence
• Finding: Piping generated JSON into sudo tee writes a root-owned external-extension config that instructs the browser to load the downloaded CRX at startup. While the JSON content is quoted safely, this still finalizes privileged persistence of the extension without validating that the installed artifact is the intended one.

Intent-Code Divergence

Medium

• Confidence: 88% confidence
• Finding: The inline documentation states the script installs policies to allow Chrome Web Store installation, while the manifest explicitly says extension installation must be via CRX only and never Chrome Web Store UI. This is a direct contradiction between documented intent and declared skill intent.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: The script writes system-wide managed policies into multiple Chrome/Chromium policy directories, affecting all users and browser instances on the host rather than only the DataHive setup flow. Because the allowed sources include broad Google extension endpoints, this weakens extension-installation restrictions across the machine and can facilitate persistence or privilege abuse through unauthorized browser extensions.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

EOF
  fi

  ${SUDO} chmod 644 "$file"
  echo "WROTE:$file"
}

• Confidence: 80% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.