Security checks for vulnerabilities and agentic risk
Overview
The skill appears to deploy the promised remote browser, but it uses broad root privileges and persistent remote desktop/browser services that need careful review before installation.
Install only on a disposable or dedicated machine where a persistent remote browser is acceptable. Review firewall exposure for port 6080, avoid public internet access unless protected by VPN or another authenticated tunnel, do not grant NOPASSWD: ALL, and prefer running the browser/services as an unprivileged user with pinned dependencies and a clear uninstall path.
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
System PersistenceInstalls backdoors, hooks, services, or scheduled tasks that survive the run
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Findings (6)
T01 · Skill Instruction Hijacking
Error
Location
SKILL.md:45
Finding
Agent Behavior Override Through Highest-Priority Skill Instructions
Content
View full analysis
Remediation
View remediation
T05 · Unauthorized Access and Privilege Escalation
Error
Location
SKILL.md:117
Finding
Unrestricted Passwordless Root Access Granted to the Deployment User
Content
View full analysis
Remediation
View remediation
T05 · Unauthorized Access and Privilege Escalation
Warning
Location
SKILL.md:67
Finding
Unnecessary Probing of Cloud Instance Metadata Services
Content
View full analysis
/dev/null | grep -q .; then
echo "ENV_TYPE=CLOUD"
elif curl -s --connect-timeout 2 http://100.100.100.200/latest/meta-data/ 2>/dev/null | grep -q .; then
echo "ENV_TYPE=CLOUD"
elif curl -s --connect-timeout 2 http://169.254.169.254/latest/meta-data/ 2>/dev/null | grep -q .; then
echo "ENV_TYPE=CLOUD"
fi
```
### Technical Analysis
The shown requests query only metadata root paths and do not explicitly request temporary credential endpoints. Consequently, direct credential theft is not demonstrated by the audited content.
Nevertheless, these hosts provide access to sensitive instance metadata and, depending on provider configuration, temporary identity credentials. Probing them is not necessary to deploy noVNC or Chromium. Environment type can be supplied by the user or inferred from non-sensitive local indicators. The mandatory metadata access also normalizes contact with a credential-bearing service and creates unnecessary exposure if this logic is later incorporated into a proxyable or attacker-influenced request path.
The calls do not use token-based AWS IMDSv2 authentication, and the generic link-local request can produce false cloud classifications in non-cloud environments.
### Attack Path
1. The Skill requires environment detection before deployment.
2. The Agent sends HTTP requests to provider-specific and link-local metadata services.
3. On a cloud host, the process establishes access to the metadata interface.
4. A future modification, redirected request flow, or compromised deployment process could request identity-role endpoints through the same access path.
5. Returned temporary credentials could then grant the instance's cloud IAM privileges.
### Impact Assess
...[truncated 308 chars]
Remediation
View remediation
T06 · System Persistence
Error
Location
SKILL.md:284
Finding
Persistent Root-Owned Remote Desktop and Browser Services Enabled Automatically
Content
View full analysis
Remediation
View remediation
T09 · Insecure Skill Coding Practices
Error
Location
SKILL.md:220
Finding
Chromium Runs as Root Without Its Sandbox and With Permissive CDP Origins
Content
View full analysis
Remediation
View remediation
T08 · Insecure Dependencies
Error
Location
SKILL.md:127
Finding
Unpinned Remote Dependencies Are Installed Globally With Elevated Privileges
Code accesses a cloud instance metadata endpoint (e.g. 169.254.169.254). A single request can return temporary IAM credentials, making this a high-value SSRF target for credential theft.
Content
Scanner excerpt · SKILL.md (reported line 73)May include surrounding context.
Code accesses a cloud instance metadata endpoint (e.g. 169.254.169.254). A single request can return temporary IAM credentials, making this a high-value SSRF target for credential theft.
Content
Scanner excerpt · SKILL.md (reported line 75)May include surrounding context.
The instructions tell the user to grant full passwordless sudo without a clear warning that this is root-equivalent access and can affect the entire system. Normalizing such escalation in a convenience flow materially increases the chance of unsafe deployment.
Content
No source excerpt is available for this finding.
Context-Inappropriate Capability
High
Category
Not specified by scanner
Confidence
99% confidence
Finding
The skill explicitly instructs granting the current user unrestricted passwordless sudo via NOPASSWD: ALL. That materially exceeds the minimum privilege needed to deploy a browser stack and creates a host-compromise pathway if the agent, user session, or follow-on commands are abused.
Content
No source excerpt is available for this finding.
Chaining Abuse
High
Category
Tool Misuse
Confidence
75% confidence
Finding
Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.
Content
Scanner excerpt · SKILL.md (reported line 119)May include surrounding context.
The skill description markets one-click deployment but does not upfront warn that it exposes a remotely accessible desktop/browser endpoint and may require opening firewall ports. Users can underestimate the network exposure and deploy it in contexts where remote access is unacceptable.
Content
No source excerpt is available for this finding.
Sudo/Root Execution
Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content
Scanner excerpt · SKILL.md (reported line 35)May include surrounding context.
md
**不适合场景：**
- 纯 API 调用任务，不需要浏览器画面
- 对安全要求极高、不能暴露任何远程桌面入口的生产环境
- Linux 模式：无法开放 `6080/tcp` 或无法提供 root/sudo 权限的服务器（Windows 模式无此限制）
**最终效果：**
- Linux 模式：用户访问 `http://<服务器IP>:6080/vnc.html`，Agent 控制 `http://127.0.0.1:9223/json`
Sudo/Root Execution
Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content
Scanner excerpt · SKILL.md (reported line 109)May include surrounding context.
md
**不适合场景：**
- 纯 API 调用任务，不需要浏览器画面
- 对安全要求极高、不能暴露任何远程桌面入口的生产环境
- Linux 模式：无法开放 `6080/tcp` 或无法提供 root/sudo 权限的服务器（Windows 模式无此限制）
**最终效果：**
- Linux 模式：用户访问 `http://<服务器IP>:6080/vnc.html`，Agent 控制 `http://127.0.0.1:9223/json`
Sudo/Root Execution
Medium
Category
Privilege Escalation
Confidence
99% confidence
Finding
This is the concrete step that grants passwordless sudo for all commands to the current user. It is a direct privilege-escalation expansion that can be exploited by any subsequent command execution in the session.
Content
Scanner excerpt · SKILL.md (reported line 118)May include surrounding context.
The firewall-opening and port-forwarding steps increase attack surface by exposing a remote desktop/browser service, but the skill does not pair them with a direct warning about internet reachability, credential risks, or recommended network restrictions. This can lead to inadvertent exposure of an interactive browser environment.
Content
No source excerpt is available for this finding.
Sudo/Root Execution
Medium
Category
Privilege Escalation
Confidence
80% confidence
Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content
Scanner excerpt · SKILL.md (reported line 199)May include surrounding context.
The startup flow hardcodes navigation to https://www.baidu.com/, a Chinese-localized site, and later verification instructs opening Baidu as a default confirmation page. This imposes a language/locale choice without offering the user an option or documenting a justified region-specific requirement.
Content
No source excerpt is available for this finding.
Session Persistence
Medium
Category
Rogue Agent
Confidence
80% confidence
Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content
Scanner excerpt · SKILL.md (reported line 362)May include surrounding context.
The skill repeatedly states that the browser should auto-open Baidu and tells the user that Baidu has been opened as part of completion messaging. This is a natural-language locale policy issue because it defaults users into a Chinese-language web experience without offering a language choice or explaining a region-specific necessity.
Content
No source excerpt is available for this finding.
Internal Network Request
Medium
Category
Server-Side Request Forgery
Confidence
70% confidence
Finding
Code issues a request to a loopback, link-local, or private-range host. This can reach internal services not meant to be exposed and is a common SSRF pivot.
Content
Scanner excerpt · SKILL.md (reported line 379)May include surrounding context.
md
import json, time, urllib.request
import websocket
tabs = json.load(urllib.request.urlopen('http://127.0.0.1:9223/json'))
page = next(t for t in tabs if t.get('type') == 'page')
ws = websocket.create_connection(
page['webSocketDebuggerUrl'],
Internal Network Request
Medium
Category
Server-Side Request Forgery
Confidence
70% confidence
Finding
Code issues a request to a loopback, link-local, or private-range host. This can reach internal services not meant to be exposed and is a common SSRF pivot.
Content
Scanner excerpt · SKILL.md (reported line 544)May include surrounding context.
md
import json, time, urllib.request
import websocket
tabs = json.load(urllib.request.urlopen('http://127.0.0.1:9223/json'))
page = next(t for t in tabs if t.get('type') == 'page')
ws = websocket.create_connection(
page['webSocketDebuggerUrl'],
Internal Network Request
Medium
Category
Server-Side Request Forgery
Confidence
70% confidence
Finding
Code issues a request to a loopback, link-local, or private-range host. This can reach internal services not meant to be exposed and is a common SSRF pivot.
Content
Scanner excerpt · SKILL.md (reported line 687)May include surrounding context.
md
import json, time, urllib.request
import websocket
tabs = json.load(urllib.request.urlopen('http://127.0.0.1:9223/json'))
page = next(t for t in tabs if t.get('type') == 'page')
ws = websocket.create_connection(
page['webSocketDebuggerUrl'],
Ssd 3
Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding
The skill instructs the agent to read a locally stored secret and disclose it in plain output. Although the password is intended for the user, normalizing plaintext secret extraction/output increases leakage risk through logs, transcripts, shared channels, or unintended recipients.
Content
No source excerpt is available for this finding.
Ssd 3
Medium
Category
Not specified by scanner
Confidence
86% confidence
Finding
The reply templates require echoing the access credential back to the user as standard output, which may place the password into conversation logs or third-party messaging systems. For a service exposing a remote desktop endpoint, credential disclosure in routine output meaningfully raises takeover risk.
Content
No source excerpt is available for this finding.
Session Persistence
Medium
Category
Rogue Agent
Confidence
60% confidence
Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content
Scanner excerpt · SKILL.md (reported line 486)May include surrounding context.
