Security audit

App Publish

Security checks for vulnerabilities and agentic risk

Overview

This skill does what it says, but it can publish real videos from logged-in accounts and includes under-disclosed stealth browser automation.

Install only if you are comfortable letting the skill control a logged-in Chrome browser and potentially publish videos publicly. Use a dedicated Chrome profile, keep the debugging port local, run --no-publish first, avoid publish-all until you have verified each platform flow, and delete any debug HTML snapshots that may contain account or draft data.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (14)

Context-Inappropriate Capability

Medium

Confidence: 95% confidence
Finding: This code injects stealth JavaScript to falsify browser automation indicators such as navigator.webdriver, Chrome runtime presence, WebGL vendor/renderer, and language settings. In the stated context of automating posting to third-party platforms, this is an anti-detection evasion capability that can be used to bypass platform bot defenses and conceal non-human activity.

Context-Inappropriate Capability

Medium

Confidence: 90% confidence
Finding: The browser setup overrides user agent metadata and device metrics to imitate a real interactive browser profile rather than exposing the actual automation environment. In combination with CDP control and posting automation, this increases the ability to evade detection and misrepresent the client identity to external services.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The skill explicitly supports one-click publishing to multiple real platforms and includes commands that perform actual submission, but the documentation does not prominently warn that these actions can immediately and irreversibly post content under the user's logged-in accounts. In the context of browser automation against creator platforms, accidental execution can cause unintended public posting, reputational harm, or policy violations across several platforms at once.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The script attaches to a local Chrome DevTools session, navigates to a real web page, and extracts DOM data including textarea values, button text, file input metadata, and the current URL. In a shared or already-authenticated browser context, this can expose sensitive page contents or account state without any user consent prompt, scope restriction, or disclosure, making it a genuine privacy and data-exposure risk.

Missing User Warnings

Medium

Confidence: 84% confidence
Finding: Chrome is launched with a persistent profile directory under ~/.kbs/chrome-profile, which can retain cookies, tokens, browsing history, downloaded files, and other sensitive local state across runs. In an agent skill context, that increases the chance of unintended credential persistence and cross-task data leakage, especially when remote debugging is also enabled.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: The code can terminate whatever process is listening on the configured port, not necessarily a Chrome instance started by this module. In shared or multi-user environments, that can disrupt unrelated services and may be abused to cause denial of service if an attacker can influence the chosen port or trigger restart/kill flows.

Missing User Warnings

Medium

Confidence: 89% confidence
Finding: The script writes the full DOM of an authenticated creator portal page to disk, which can capture sensitive session-dependent content such as account data, upload metadata, CSRF tokens, internal identifiers, or private media-related information. In this skill context, the risk is elevated because the page is accessed through a live browser automation session against a real publishing platform, so the saved HTML may persist sensitive data beyond the intended debugging session.

Missing User Warnings

Medium

Confidence: 89% confidence
Finding: The function will automatically click a publish/submit button when do_publish is left at its default value of True, with no built-in confirmation step at the moment of submission. In an automation skill that uploads content to a live creator platform, this can cause unintended public posting, reputational harm, and accidental release of sensitive or unreviewed media if invoked in the wrong context or with untrusted inputs.

Vague Triggers

Medium

Confidence: 90% confidence
Finding: The task description is broad and under-specified: it instructs generating an automation script that takes input files and uploads content to multiple publishing platforms, but does not clearly define when the skill should or should not run, what confirmations are required, or what safety boundaries apply. In a skill that performs external side effects on user accounts, vague triggering conditions increase the risk of unintended publication, misuse of local files, or execution in the wrong context.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The document describes automatically uploading content to external publishing pages and then waiting to check status, but it does not clearly warn about the consequences of acting on behalf of the user, such as publishing media to public platforms, consuming account privileges, or exposing private/local content. Because the skill references a local test data path and multiple creator portals, the context makes this more dangerous: it combines local file access with real external actions and lacks explicit consent, preview, rollback, or safety disclosure.

Unpinned Dependencies

Low

Category: Supply Chain
Content: requests>=2.28.0 websockets>=12.0
Confidence: 94% confidence
Finding: The dependency is specified with a lower bound only, which allows future installs to resolve to different versions over time. This weakens build reproducibility and can unintentionally introduce vulnerable or breaking upstream releases into the environment.

Unpinned Dependencies

Low

Category: Supply Chain
Content: requests>=2.28.0 websockets>=12.0
Confidence: 94% confidence
Finding: The package is not pinned to a single vetted version, so installations may pull different releases depending on when and where the environment is built. This increases supply-chain risk and makes it easier for vulnerable versions to be introduced unintentionally.

Known Vulnerable Dependency: requests — 10 advisory(ies): CVE-2014-1830 (Exposure of Sensitive Information to an Unauthorized Actor in Requests); CVE-2024-47081 (Requests vulnerable to .netrc credentials leak via malicious URLs); CVE-2024-35195 (Requests `Session` object does not verify requests after making first request wi) +7 more

High

Category: Supply Chain
Confidence: 87% confidence
Finding: `requests>=2.28.0` permits installation of affected versions if the environment resolves to a release with known advisories, and the requirement does not constrain to a minimum patched version for the cited issues. Because this is a network-facing HTTP client library, exploitation could lead to credential leakage, TLS/request validation issues, or other security failures depending on how the package is used.

Known Vulnerable Dependency: websockets — 4 advisory(ies): CVE-2018-1000518 (websockets is vulnerable to denial of service by memory exhaustion); CVE-2021-33880 (Observable Timing Discrepancy in aaugustin websockets library); CVE-2018-1000518 (aaugustin websockets version 4 contains a CWE-409: Improper Handling of Highly C) +1 more

High

Category: Supply Chain
Confidence: 82% confidence
Finding: `websockets>=12.0` may still allow vulnerable releases if any advisories affect versions at or above 12.0, and the requirement does not document or enforce a patched safe version. Since this library commonly handles untrusted network input, known issues such as denial of service or protocol-handling weaknesses can have real operational impact.

Static analysis

No suspicious patterns detected.