Web Collection

• Outcome: Review
• Latest audit: Jun 28, 2026 · 3:36 AM UTC
• Version: 1.2.9

Overview

This skill appears purpose-built for browser-based data collection, but it uses stored connector credentials and raw shell-based helper paths with broad authority that users should review before installing.

Install only if you trust the publisher and the connector service. Before using it, verify generated login links and cloud base URLs, avoid passing untrusted --bridge-cmd values, understand that it may reuse stored connector/App credentials, and treat Bitable authorization codes and connector tokens as sensitive secrets.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (12)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 94% confidence
• Finding: The skill instructs the agent to use shell scripts, environment variables, local state files, and multiple network endpoints, but it declares no permissions or trust boundaries. This creates a real security risk because the host or reviewer cannot accurately constrain execution, network egress, or secret access, and the skill explicitly handles connector tokens, device identifiers, and browser-automation flows.

Context-Inappropriate Capability

Medium

• Confidence: 91% confidence
• Finding: The script implicitly sources an administrative token from either an environment variable or a local file and then uses it for API calls, even though its apparent purpose is a simple re-export helper. This broadens privilege use beyond what a minimally scoped utility needs and can cause users to unknowingly perform privileged operations or expose a high-value credential path to other tooling and logs.

Context-Inappropriate Capability

High

• Confidence: 97% confidence
• Finding: The script captures output from an external helper and executes it with eval, which allows that helper to return arbitrary shell commands, not just variable assignments. If the helper is compromised, replaced, or influenced by attacker-controlled input, this becomes arbitrary code execution in the context of the user running the skill. In a web collection skill, executing shell code from helper output is broader than the stated purpose and materially increases risk.

Context-Inappropriate Capability

High

• Confidence: 95% confidence
• Finding: The runner accepts a bridge command from an environment variable or CLI and later executes it to start a local bridge. That creates a direct arbitrary command execution path, so anyone who can influence invocation parameters or environment can run unrelated local programs under the user's privileges. This exceeds what is necessary for a collection wrapper and is especially risky in an agent skill context where parameters may be indirectly derived from user prompts or stored configuration.

Vague Triggers

Medium

• Confidence: 88% confidence
• Finding: The default prompt activates the skill for broad categories like '首次上手和 QA 问题' and generic web data collection without clear scoping, confirmation, or domain restrictions. In an agent routing context, this can cause the skill to be invoked for loosely related requests and perform browser- or connector-based actions unexpectedly, increasing the chance of over-collection, unintended external access, or misuse on unsupported targets.

Natural-Language Policy Violations

Medium

• Confidence: 84% confidence
• Finding: The skill metadata and default prompt are written to operate in Chinese without any indication that this behavior is conditional on user preference. This can create instruction-priority and usability issues where the agent responds in an unexpected language, causing user misunderstanding of what data collection will occur and reducing informed consent for connector-driven actions.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The script starts the bridge with `nohup bash -lc "$BRIDGE_CMD"`, which executes a free-form shell command string. If an untrusted party can influence `--bridge-cmd` or cause this script to be invoked with attacker-controlled parameters, this becomes arbitrary command execution with the privileges of the script user and persistence via background execution.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The script silently reads and applies an admin token in authenticated HTTP requests without any user-facing disclosure or confirmation. In a skill intended for data collection and export workflows, this makes privileged behavior less transparent and increases the chance of unintended administrative actions against the connector service.

External Transmission

Medium

• Category: Data Exfiltration

Content

api_get() {
  local path="$1"
  curl -fsS \
    -H "Authorization: Bearer $TOKEN" \
    "$BASE_URL$path"
}

• Confidence: 86% confidence
• Finding: curl -fsS \ -H "Authorization: Bearer $TOKEN" \ "$BASE_URL$path" } api_get_optional() { local path="$1" local raw http_code body raw="$(curl -sS -w $'\n%{http_code}' \ -H "Authoriza

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

Connector guidance constraints:

- Do not ask the user to manually copy `device_id`, `connector_token`, `Token`, or `API token` during normal Agent-led use.
- When connector authorization is missing or expired, generate the website login confirmation link through the bundled scripts and ask the user to click it.
- The user's action should be described simply as: open the Agent-provided link, finish website login/authorization, then return to the Agent.
- Do not tell the user to click `免费获取云端连接器凭证`.

• Confidence: 81% confidence
• Finding: Do not ask the user

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

- When responding to the user, put the detailed guide link at the end of the message, after all operations and screenshots:
     `https://vcn5grhrq8y0.feishu.cn/wiki/EAtJw2irFiDvMpkZXb4cBjYonNg`
3. Guide connector authorization.
   - Do not ask the user to copy credentials by default.
   - When authorization is needed, run the normal collection entry point or `scripts/ensure_connector_auth.sh`; it will generate a website login confirmation link.
   - Tell the user: open the link, finish website login/authorization, then return to the Agent and retry/continue.
   - After confirmation, the connector/App writes `connector_token`, `ws_url`, and `device_id` into its own state. The Skill should reuse that state automatically.

• Confidence: 83% confidence
• Finding: Do not ask the user

Session Persistence

Medium

• Category: Rogue Agent

Content

- `assets/bitable-step-00-personal-center.png`
  - Use when telling the user to open the browser extension, enter `个人中心`, and log in.
- `assets/bitable-step-01-template-copy.png`
  - Use when telling the user to open the direct bitable template link and create a copy.
- `assets/bitable-step-02-auth-code.png`
  - Use when telling the user to open `多维表格插件` -> `自定义插件` and copy the authorization code.
- `assets/bitable-step-03-config-save.png`

• Confidence: 79% confidence
• Finding: create a copy. - `assets/bitable-step-02-auth-code.png` - Use when telling the user to open `多维表格插件` -> `自定义插件` and copy the authorization code. - `assets/bitable-step-03-config-save.png` - Use wh

VirusTotal

64/64 vendors flagged this skill as clean.

Static analysis

Detected: suspicious.dangerous_exec

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: scripts/preflight_check.sh:254