Security audit

aky-public-opinion 2.0

Security checks for vulnerabilities and agentic risk

Overview

This is mostly a report-writing skill, but it needs review because it directs broad political and social-media collection with browser scraping and includes ambiguous login-wall or paywall bypass guidance.

Review this skill before installing if you will use it on political, diplomatic, ethnic, religious, ideological, or media-monitoring topics. It should only collect public or explicitly authorized content, should not bypass paywalls or login walls, and browser automation should be run through structured tools with user confirmation for external collection.

A.I.G

Vulnerability Patterns

Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T05 · Unauthorized Access and Privilege Escalation

Warning

Location: SKILL.md:103
Finding: Instructions Encourage Circumvention of Paywall Access Controls
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.md:119
Finding: Potential Shell Command Injection Through Untrusted Browser Arguments
Content: View full analysis
# 2. Wait for loading to complete and capture interactive elements agent-browser wait --load networkidle agent-browser snapshot -i --json # 3. Find the search field using its reference and enter the keyword agent-browser fill @ "" ``` ### Technical Analysis The command templates place dynamic URL, element-reference, and keyword values directly into shell command lines. These values may originate from user input, search results, or untrusted web content. Quoting the keyword with double quotes is not sufficient shell protection. In common shells, command substitutions such as `$(command)` and backtick expressions are still evaluated inside double quotes. The unquoted URL and reference placeholders can also introduce shell metacharacters, argument injection, redirection, pipelines, or additional commands. The issue is exploitable if an agent substitutes untrusted values into these templates and executes the resulting text through a shell. It is not exploitable when the browser is invoked through a structured tool API or a process-spawning interface that passes each argument separately without shell interpretation. ### Attack Path 1. An attacker provides a search keyword, URL, or browser element reference containing shell metacharacters or command-substitution syntax. 2. The agent substitutes that value into the documented command template. 3. The agent executes the resulting command using a shell. 4. The shell evaluates the injected syntax before or alongside the intended `agent-browser` command. 5. The injected local command runs with the same operating-system privileges and environment access as the agent process. For example, a keyword ...[truncated 917 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (6)

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The invocation guidance is broad enough to activate this skill for generic requests like sentiment analysis or summaries, which can cause the agent to enter a workflow that performs extensive monitoring and scraping without the user explicitly requesting cross-platform collection. In this skill’s context, that is more concerning because the workflow includes social-media tracking, international media collection, and politically sensitive analysis domains, increasing the chance of unintended surveillance-style use or over-collection.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The skill prominently instructs the agent to gather data from X.com, search engines, and direct media scraping tools, including headless browser automation, but does not require a clear disclosure to the user that external sites may be accessed and scraped. This is dangerous because users may unknowingly trigger outbound browsing and collection of third-party content, and in this skill’s context the collection targets politically sensitive topics and social discourse, raising privacy, compliance, and reputational risks.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: Forcing Chinese-only output without checking the user’s language preference can cause misunderstanding of sensitive analysis, citations, and recommendations, especially when the underlying sources are multilingual. In this skill’s context, the risk is amplified slightly because it handles international media narratives and policy-sensitive reporting, where translation errors or opaque output can mislead users and reduce informed consent about the report contents.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The template hard-codes Chinese-language output and an official-document tone as the default deliverable, without indicating any user choice or consent mechanism. In this skill context, that creates a meaningful steering risk: users may be funneled into producing state-style public-opinion and risk reports even when they requested a neutral, different-language, or less sensitive format.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The guidance requires specific Chinese enumeration patterns and stock phrasing, which further constrains outputs toward a particular official framing rather than adapting to user intent. In a skill designed for government and enterprise sentiment analysis, this can normalize one-sided, authority-coded messaging and reduce transparency that the style is being imposed by the template rather than chosen by the user.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The general standards prescribe a fixed official-document style, stock phrases such as guidance/control language, and sensitive-information handling rules without any documented opt-in or balancing constraints. Given this skill's explicit use for public-opinion tracking, diplomatic sensitivity, and ideological analysis, the fixed framing increases the risk of producing persuasive or surveillance-oriented content tailored to state-style information control rather than user-directed analysis.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.