Security audit
Security checks for vulnerabilities and agentic risk
The downloader has useful safeguards, but conflicting instructions could let an agent choose or create browser profiles without clear user approval.
This belongs in Review because browser-profile authorization is inconsistent. Specify the exact browserId and require separate permission for profile creation, switching, startup, or software installation. Prefer reviewed installer versions and repository revisions. The inspected artifacts do not substantiate credential theft, shell injection, or malicious intent.
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
"--config=/tmp/curlrc",
"\nhttps://www.douyin.com/video/123456789012",
"javascript:https://www.douyin.com/video/123456789012",
"file:///etc/passwd",
]
for value in bad_inputs:
with self.subTest(value=value), patch.object(MODULE, "run") as run:
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
def test_media_urls_reject_local_schemes_hosts_and_private_dns(self):
for url in (
"file:///etc/passwd", "http://media.example/video", "https://localhost/video",
"https://127.0.0.1/video", "https://::1/video", "https://***@public.example/video",
"https://media.example./video",
):
The documented npx skills add command can download and execute an unpinned npm package with the user's local privileges. This creates a supply-chain exposure if a future release or the package's distribution is compromised; however, the scanner's description of this CLI as an MCP server is inaccurate.
Avoiding repeated approval for ordinary steps in an authorized download is not inherently unsafe. Here, however, the instruction not to request reconfirmation accompanies permission to create and start browser environments, allowing consent for the download to be stretched into consent for environment management; this overlaps with SDI-1 rather than representing a separate exploit.
udes the Bridge and browser extension on Apple Silicon Macs and Windows, so no separate Bridge installation is needed there. Ordinary browsers and other systems require the full Easy WebBridge setup described in the official guide.
For a browser task the user has authorized through this Skill, check and reuse a suitable existing environment first. If a new one is genuinely needed, create one unique environment for this task with safe defaults, read back its actual environment ID, and start it. Do not ask the user to reconfirm or supply an environment name or default parameters. After confirming the correct account and `browserId`, continue the user's current task instead of stopping at setup instructions; do not ask for approval at each necessary step. Pause only for CAPTCHA/account security checks, real ambiguity about the target account or authorization, or missing local-control capability. At completion, close only the task tab group created for this run and report results and limi
The onboarding paragraph permits the agent to select a 'suitable' environment or create and start a new one, whereas the metadata and earlier requirements restrict use to an explicitly selected browser or the sole online browser. These conflicting instructions can cause an agent to treat authorization for a download as authorization for broader browser-environment management; the account-confirmation and ambiguity checks reduce, but do not eliminate, that risk.
The documented npx skills add command can download and execute an unpinned npm package with the invoking user's privileges. Although this is an installer rather than an MCP server, the underlying supply-chain concern is valid: a compromised or unexpected release could execute code during installation. The ordinary installation context suggests convenience rather than malicious intent, and no package compromise is established.
The concluding workflow allows the agent to select an existing browser environment or create one without further confirmation, conflicting with the earlier requirement to obtain an explicit selection when multiple environments are online. Authorization for a download does not necessarily authorize choosing among authenticated browser profiles, so this ambiguity could cause access through the wrong account or unwanted environment creation. The instruction to confirm the account and browserId mitigates the risk but does not define how user selection must be obtained.
Without declared permissions the skill's intent is opaque and cannot be validated.
The continuation section permits the agent to choose an existing 'suitable' browser or create and start a new environment without further confirmation, contradicting the earlier requirement for explicit selection whenever multiple browsers are online. This ambiguity can cause an agent to operate in an unintended authenticated account context or create an environment beyond the stated authorization boundary; the instruction to verify the account and browserId mitigates but does not resolve the selection conflict.
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
def run(cmd, desc=""):
"""执行命令，返回 (returncode, stdout, stderr)"""
try:
p = subprocess.run(cmd, capture_output=True, text=True, timeout=120)
return p.returncode, p.stdout, p.stderr
except subprocess.TimeoutExpired:
return -1, "", f"timeout: {desc}"
Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.
permit persons to whom the Software is furnished to do so.
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED,
INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A
PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT
HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION
OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE
No suspicious patterns detected.