nl2ms-ui

• Outcome: Review
• Latest audit: Sep 10, 2026 · 3:36 PM UTC
• Version: 1.0.0

Overview

This skill is a UI automation script generator, but its examples normalize accepting permissions and user agreements and sending live messages without clear confirmation safeguards.

Install only if you intend to generate Midscene automation for controlled test environments. Before running generated scripts, remove blanket auto-consent instructions, use test accounts and test recipients, avoid production session state, and do not disable the browser sandbox unless your isolated runtime requires it.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: references/examples-web-ts.md:32
• Finding: Chromium Sandbox Disabled by Default## Vulnerability Details **File Location**: `references/examples-web-ts.md`, lines 32–35 **Vulnerability Type**: Browser process isolation disabled **Risk Level**: Medium ### Vulnerable Code ```typescript this.browser = await chromium.launch({ headless: options.headless ?? false, args: ["--no-sandbox", "--disable-setuid-sandbox"], }); ``` ### Technical Analysis The example launches Chromium with both `--no-sandbox` and `--disable-setuid-sandbox`. These flags disable Chromium's process sandbox, removing an important defense-in-depth boundary between untrusted web content and the host environment. The same example later navigates to the caller-controlled `options.url`. If the selected website is malicious or compromised, its content is processed by a browser running without normal sandbox isolation. Exploitation still requires a suitable Chromium or rendering-engine vulnerability; the flags do not independently provide arbitrary code execution. However, they can substantially increase the impact of such a vulnerability by weakening containment. ### Attack Path 1. A user copies or runs the Web automation example. 2. Chromium starts with its sandbox protections disabled. 3. The automation navigates to an attacker-controlled or compromised URL through `options.url`. 4. Malicious content exploits a browser or rendering-engine vulnerability. 5. Because sandbox isolation is disabled, the exploit may access resources available to the browser process without first overcoming Chromium's normal sandbox boundary. ### Impact Assessment Successful exploitation could allow execution with the privileges of the account running the automation. Depending on that account's permissions and environmental controls, an attacker could potentially access readable local files, authentication state, environment variables, or network resources available to the process. The issue does not directly grant elevated operating-system privileges. Its practical scope is limited by t ...[truncated 128 chars]
• Remediation: ## Remediation Suggestions 1. Remove `--no-sandbox` and `--disable-setuid-sandbox` so Chromium uses its default sandbox: ```typescript this.browser = await chromium.launch({ headless: options.headless ?? false, }); ``` 2. If a constrained runtime cannot support Chromium's sandbox, treat sandbox disabling as an explicit exceptional configuration rather than the default. 3. Run browser automation as a dedicated, unprivileged operating-system user. 4. Use a strongly isolated container or virtual machine with minimal filesystem mounts, restricted network access, dropped Linux capabilities, and no host credentials. 5. Keep Chromium and Playwright updated with current security patches. 6. Validate or allowlist navigation targets when URLs can originate from untrusted input. 7. Avoid exposing sensitive environment variables and reusable authenticated browser state to browser automation that may visit untrusted sites.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (16)

Credential Access

High

• Category: Privilege Escalation

Content

```typescript
import { agentFromWebDriverAgent } from '@midscene/ios';
import "dotenv/config"; // read environment variables from .env file

const sleep = (ms: number) => new Promise((r) => setTimeout(r, ms));

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

```typescript
import { agentFromWebDriverAgent } from '@midscene/ios';
import "dotenv/config"; // read environment variables from .env file

const sleep = (ms: number) => new Promise((r) => setTimeout(r, ms));

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Missing User Warnings

High

• Confidence: 99% confidence
• Finding: The example instructs the agent to automatically click “agree” on permission, location, and user agreement dialogs without user review. This normalizes bypass of meaningful consent gates and can grant sensitive permissions or acceptance of terms that materially affect privacy, security, or legal posture.

Credential Access

High

• Category: Privilege Escalation

Content

// 加载环境变量，指定.env文件路径
dotenv.config({ 
  path: join(__dirname, "../../.env")
});

import {

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Vague Triggers

Medium

• Confidence: 91% confidence
• Finding: The trigger description is broad enough to activate on generic requests about generating scripts across several platforms, without requiring clear scope, authorization, or task boundaries. In an agent environment, this can cause inappropriate skill selection and lead to unintended generation of automation code for sensitive targets or contexts the user did not explicitly qualify.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The example explicitly configures the Android agent to automatically accept permission prompts and user agreements, and to dismiss login pages. In an automation skill that generates runnable scripts, this normalizes bypassing consent and can cause unintended approval of privacy-sensitive permissions or legal agreements without user awareness.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The example explicitly instructs the agent to automatically accept permission requests and user agreements, and to dismiss login screens, without requiring user confirmation or warning. In an automation context, this can cause unintended consent to privacy-sensitive permissions, acceptance of legal terms, or bypass of user decision points, making the generated scripts unsafe if reused as-is.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The example is a fully executable script that launches a real app, navigates to a real user chat, inputs text, and taps the send button, but the surrounding documentation does not clearly warn that it performs a live message send. In an automation skill that converts natural language into executable mobile scripts, omission of this warning increases the risk of unintended real-world actions against production accounts or contacts.

Ssd 4

Medium

• Confidence: 98% confidence
• Finding: Embedding a persistent action context that tells the agent to close login screens and agree to dialogs creates a trust-bypassing workflow: the model is primed to suppress friction intended to obtain informed user consent or authentication. In this skill context, which generates automation scripts from natural language, that pattern is especially risky because it can be copied into broader workflows and reused against real apps.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The example script explicitly captures screenshots of a live PC application and performs UI actions that modify real chat state by sending an emoji, but it provides no warning, consent boundary, or guidance about using a test account/environment. In an automation skill, this can lead users to run the example against production chats and unintentionally expose sensitive on-screen data or send messages to real recipients.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The example provides a complete automation flow for searching a user and sending a message in a PC app, but it includes no confirmation, authorization, or warning that the action will communicate externally on the user's behalf. In an agent skill context, this can normalize or enable unintended outbound actions such as messaging the wrong recipient, spamming, or performing social actions without explicit user consent at execution time.

Natural-Language Policy Violations

Medium

• Confidence: 95% confidence
• Finding: This markdown skill file presents all instructions, headings, and examples only in Chinese. Under the policy rule for natural-language violations, forcing a specific language without user opt-in or justification is in scope.

Natural-Language Policy Violations

Medium

• Confidence: 95% confidence
• Finding: The file title, examples, assertions, and operation descriptions are entirely in Chinese, with no indication that the skill is region-specific or that another language is supported. This creates a natural-language locale constraint that is not presented as an opt-in choice or justified as a China-specific compliance requirement.

Vague Triggers

Low

• Confidence: 82% confidence
• Finding: The usage guidance lists cases where the skill may be used, but does not define when it must not activate or what prerequisites are needed. This ambiguity increases the chance of accidental invocation, which can produce irrelevant or risky automation artifacts in contexts where another skill or a manual clarification step would be safer.

Vague Triggers

Low

• Confidence: 77% confidence
• Finding: This markdown file presents an Android YAML skill example but does not specify when the example skill should be invoked, what user intent should activate it, or any negative examples that limit scope. For manifest-like instructional content, the absence of trigger specificity can contribute to overly broad or unintended activation interpretations.

Natural-Language Policy Violations

Low

• Confidence: 95% confidence
• Finding: The natural-language content, including the title, instructions, and descriptions, is presented only in Chinese. Under the policy, forcing a specific language without user opt-in can be a language/locale policy violation unless the constraint is explicitly justified, which is not stated here.

Static analysis

No suspicious patterns detected.