m44 internal testing

• Outcome: Review
• Latest audit: Sep 10, 2026 · 10:54 PM UTC
• Version: 1.0.0

Overview

This installer appears intended to set up DataHive, but it makes persistent system-wide browser extension changes that are broader than the stated profile-specific setup.

Review this before installing. Running it may require administrator privileges, alter Chrome/Chromium managed policies for the whole machine, persist a forced extension across sessions, and access a mailbox to consume a login magic link. Prefer running only in an isolated environment, require a rollback plan, and do not allow arbitrary extension IDs or environment-controlled WORK_DIR values.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (3)

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: scripts/install_extension_policy.sh:27

Finding

System-Wide Forced Extension Installation Exceeds the Required Profile Scope

Content

View full analysis

/dev/null ``` ```bash # scripts/install_extension_policy.sh:27-38 if [ -n "$EXT_ID" ]; then cat </dev/null { "ExtensionInstallSources": [ "https://chrome.google.com/*", "https://clients2.google.com/*", "https://chromewebstore.google.com/*" ], "ExtensionInstallForcelist": [ "${EXT_ID};${UPDATE_URL}" ] } EOF ``` ```bash # scripts/install_extension_policy.sh:56-62 # Debian/Ubuntu Google Chrome + Chromium package locations write_policy_file "/etc/opt/chrome/policies/managed" write_policy_file "/etc/chromium/policies/managed" # Chromium Snap common managed policy paths used in many headless/server setups write_policy_file "/var/snap/chromium/current/policies/managed" write_policy_file "/var/snap/chromium/current/chromium-browser/policies/managed" ``` ### Technical Analysis The declared operation is to install DataHive in the dedicated browser profile named `datahive`. The implementation instead requests administrative privileges and writes managed browser policies into four system-level Chrome and Chromium locations. `ExtensionInstallForcelist` instructs supported browsers to install and retain the extension as a managed component. Users may ...[truncated 1798 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/install_extension_crx.sh:92

Finding

Python Code Injection Through Environment-Controlled Workspace Path

Content

View full analysis

Remediation

View remediation

T08 · Insecure Dependencies

Warning

• Location: scripts/install_extension_crx.sh:43

Finding

Unpinned Remote CRX Is Installed Into Privileged Browser Locations Without Explicit Integrity Verification

Content

View full analysis

&2 exit 1 fi ``` ```bash # scripts/install_extension_crx.sh:53-70 echo "[2/6] Decoding CRX container" python3 - "$CRX_PATH" "$ZIP_PATH" <<'PY' import pathlib, struct, sys crx_path = pathlib.Path(sys.argv[1]) zip_path = pathlib.Path(sys.argv[2]) data = crx_path.read_bytes() if data[:4] != b"Cr24": raise SystemExit("Not a CRX file") ver = struct.unpack("/dev/null ``` ```bash # scripts/install_extension_policy.sh:27-37 if [ -n "$EXT_ID" ]; then cat </dev/null { "ExtensionI ...[truncated 3094 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (19)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The skill claims CRX-only installation and a narrow DataHive-specific flow, yet the underlying behavior reportedly enables broader extension installation paths and arbitrary force-install by extension ID through browser policy. In the context of browser extensions, that is high risk because extensions can access browsing data, inject scripts, and persist across sessions, while the user may believe only a limited one-off setup is occurring.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The skill claims CRX-only installation and a narrow DataHive-specific flow, yet the underlying behavior reportedly enables broader extension installation paths and arbitrary force-install by extension ID through browser policy. In the context of browser extensions, that is high risk because extensions can access browsing data, inject scripts, and persist across sessions, while the user may believe only a limited one-off setup is occurring.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/install_browser.sh (reported line 32)May include surrounding context.

sh

${SUDO} apt-get update -y
  ${SUDO} apt-get install -y wget gnupg ca-certificates
  wget -qO- https://dl.google.com/linux/linux_signing_key.pub | ${SUDO} gpg --batch --yes --dearmor -o /usr/share/keyrings/google-linux-signing-keyring.gpg
  echo "deb [arch=amd64 signed-by=/usr/share/keyrings/google-linux-signing-keyring.gpg] http://dl.google.com/linux/chrome/deb/ stable main" | ${SUDO} tee /etc/apt/sources.list.d/google-chrome.list >/dev/null
  ${SUDO} apt-get update -y
  ${SUDO} apt-get install -y google-chrome-stable

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/install_browser.sh (reported line 33)May include surrounding context.

sh

${SUDO} apt-get update -y
  ${SUDO} apt-get install -y wget gnupg ca-certificates
  wget -qO- https://dl.google.com/linux/linux_signing_key.pub | ${SUDO} gpg --batch --yes --dearmor -o /usr/share/keyrings/google-linux-signing-keyring.gpg
  echo "deb [arch=amd64 signed-by=/usr/share/keyrings/google-linux-signing-keyring.gpg] http://dl.google.com/linux/chrome/deb/ stable main" | ${SUDO} tee /etc/apt/sources.list.d/google-chrome.list >/dev/null
  ${SUDO} apt-get update -y
  ${SUDO} apt-get install -y google-chrome-stable

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 100% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · scripts/install_browser.sh (reported line 59)May include surrounding context.

sh

# Recover from stale failed install path if present.
  if [ -d /var/snap/chromium/current ] && [ ! -L /var/snap/chromium/current ]; then
    ${SUDO} rm -rf /var/snap/chromium/current || true
  fi

  ${SUDO} snap install chromium

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 100% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · scripts/install_browser.sh (reported line 59)May include surrounding context.

sh

# Recover from stale failed install path if present.
  if [ -d /var/snap/chromium/current ] && [ ! -L /var/snap/chromium/current ]; then
    ${SUDO} rm -rf /var/snap/chromium/current || true
  fi

  ${SUDO} snap install chromium

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 75% confidence

Finding

Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.

Content

Scanner excerpt · scripts/install_extension_crx.sh (reported line 100)May include surrounding context.

sh

PY
)"

printf '{"external_crx":"%s","external_version":"%s"}\n' "$EXTERNAL_CRX_PATH" "$EXT_VERSION" | sudo tee "$EXTERNAL_JSON_PATH" >/dev/null

echo "[5/6] Verifying installed files"
test -s "$CRX_PATH"

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The script explicitly configures managed browser policies to permit extension installation from Chrome Web Store domains, which contradicts the skill's stated CRX-only installation model. In the context of an installer skill, this broadens the trust boundary from a single intended extension package to any extension obtainable from the allowed sources, enabling unintended or malicious extension installation if the environment or subsequent automation is compromised.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 83% confidence

Finding

The skill directs use of shell scripts, browser/profile changes, and extension installation, but it declares no explicit tool scope or permission boundaries. That makes powerful file and shell capabilities implicit, reducing transparency and increasing the chance an agent executes privileged or system-changing actions without informed approval.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The skill performs browser profile modification and extension installation without clearly warning that it changes local browser configuration and may persist software in the user's environment. In this context, silent browser modification is risky because it alters a trusted application surface and may introduce persistent code execution through extensions.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The skill instructs the agent to access a mailbox and retrieve a magic-link email without any explicit privacy warning, consent checkpoint, or data-handling limitation. Email access is sensitive because it may expose unrelated messages, authentication links, and account takeover paths beyond the intended DataHive login.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · scripts/install_extension_crx.sh (reported line 89)May include surrounding context.

sh

PY

echo "[4/6] Installing external extension files ($BROWSER)"
sudo mkdir -p "$EXT_BASE_DIR"
sudo cp "$CRX_PATH" "$EXTERNAL_CRX_PATH"

EXT_VERSION="$(python3 - <<PY

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · scripts/install_extension_crx.sh (reported line 105)May include surrounding context.

sh

PY

echo "[4/6] Installing external extension files ($BROWSER)"
sudo mkdir -p "$EXT_BASE_DIR"
sudo cp "$CRX_PATH" "$EXTERNAL_CRX_PATH"

EXT_VERSION="$(python3 - <<PY

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · scripts/install_extension_crx.sh (reported line 106)May include surrounding context.

sh

PY

echo "[4/6] Installing external extension files ($BROWSER)"
sudo mkdir -p "$EXT_BASE_DIR"
sudo cp "$CRX_PATH" "$EXTERNAL_CRX_PATH"

EXT_VERSION="$(python3 - <<PY

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 86% confidence

Finding

This copies a CRX downloaded from the network into a root-controlled browser extension directory, causing privileged installation of code that was not cryptographically validated by the script. Because EXT_ID and PROD_VERSION are externally controllable and the script does not verify the publisher key or expected hash, a compromised download path or misconfiguration could persistently install an unintended extension with broad browser privileges.

Content

Scanner excerpt · scripts/install_extension_crx.sh (reported line 90)May include surrounding context.

sh

echo "[4/6] Installing external extension files ($BROWSER)"
sudo mkdir -p "$EXT_BASE_DIR"
sudo cp "$CRX_PATH" "$EXTERNAL_CRX_PATH"

EXT_VERSION="$(python3 - <<PY
import json

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 84% confidence

Finding

Piping generated JSON into sudo tee writes a root-owned external-extension config that instructs the browser to load the downloaded CRX at startup. While the JSON content is quoted safely, this still finalizes privileged persistence of the extension without validating that the installed artifact is the intended one.

Content

Scanner excerpt · scripts/install_extension_crx.sh (reported line 100)May include surrounding context.

sh

PY
)"

printf '{"external_crx":"%s","external_version":"%s"}\n' "$EXTERNAL_CRX_PATH" "$EXT_VERSION" | sudo tee "$EXTERNAL_JSON_PATH" >/dev/null

echo "[5/6] Verifying installed files"
test -s "$CRX_PATH"

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The inline documentation states the script installs policies to allow Chrome Web Store installation, while the manifest explicitly says extension installation must be via CRX only and never Chrome Web Store UI. This is a direct contradiction between documented intent and declared skill intent.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The script writes system-wide managed policies into multiple Chrome/Chromium policy directories, affecting all users and browser instances on the host rather than only the DataHive setup flow. Because the allowed sources include broad Google extension endpoints, this weakens extension-installation restrictions across the machine and can facilitate persistence or privilege abuse through unauthorized browser extensions.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · scripts/install_extension_policy.sh (reported line 52)May include surrounding context.

sh

EOF
  fi

  ${SUDO} chmod 644 "$file"
  echo "WROTE:$file"
}