Security audit

科研福音-小红书、抖音、b站数据抓取神器

Security checks across malware telemetry and agentic risk

Overview

This skill openly performs browser-session scraping, but it gives an agent broad CDP access to logged-in pages and exports bulk page/comment data with limited privacy guardrails.

Install only if you are comfortable letting an agent control a debugging-enabled browser session and export visible logged-in page data to Excel. Use it only on pages you are authorized to collect, close unrelated tabs, review the listed target URLs before extraction, and treat the exported spreadsheet as potentially sensitive personal data.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (10)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 95% confidence
Finding: The skill clearly requires network access to localhost over HTTP/CDP (`127.0.0.1:9222`) and external package installation, yet no explicit permission declaration is present. Missing capability/permission disclosure weakens user and platform oversight and can hide the true reach of the skill's browser-access behavior.

Context-Inappropriate Capability

Medium

Confidence: 98% confidence
Finding: Launching a browser with `--remote-debugging-port=9222` exposes a powerful control interface that can inspect pages, read DOM content, execute JavaScript, access authenticated sessions, and potentially manipulate tabs. This goes far beyond a narrow 'export data' action and materially expands the attack surface if an agent or local process misuses the CDP endpoint.

Description-Behavior Mismatch

Medium

Confidence: 97% confidence
Finding: The `generic` mode materially expands the tool from a claimed 3-platform scraper into a general-purpose browser DOM extraction utility. Because it connects to a live Chrome DevTools session and allows user-supplied selectors, it can be used to extract arbitrary content from any matching open page, increasing privacy and policy-bypass risk beyond the disclosed scope.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The skill instructs extraction of content from a logged-in browser session and export to Excel, but does not provide a clear privacy notice about what categories of data may be collected, retained, or shared. Users may not realize that visible comments, replies, author data, and other session-accessible page content are being bulk harvested and packaged for transfer.

Vague Triggers

Medium

Confidence: 89% confidence
Finding: Broad trigger phrases such as '抓评论', '抓数据', and '网页数据抓取' increase the chance of unintended invocation in contexts where the user did not specifically intend to authorize browser-connected extraction. For a skill that accesses authenticated browser content, accidental activation materially raises privacy and consent risks.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The skill is explicitly designed to connect to a local Chrome DevTools endpoint and read DOM content from pages already open in the user's browser, then persist that data to an Excel file. Without an explicit privacy warning, consent step, or target-page disclosure, users may unknowingly export sensitive content such as account data, private comments, or non-public page contents from their active browsing session.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The documentation promotes connecting to a live browser via CDP and extracting page and comment data while explicitly emphasizing the use of an existing logged-in session to bypass platform signing and anti-abuse controls, yet it provides no privacy, consent, or data-handling warnings. This is dangerous because the tool can access sensitive authenticated content visible in the browser and export it to Excel, increasing the risk of unauthorized collection, retention, and downstream leakage of personal or regulated data.

Ssd 3

High

Confidence: 99% confidence
Finding: The skill is designed to read all user-visible data from logged-in browser pages and export it into a spreadsheet, including comments and page content. Because the browser session carries authentication, this enables bulk extraction of data available through the user's account context, which can include sensitive or restricted content and creates clear privacy, compliance, and misuse risks.

Ssd 3

Medium

Confidence: 97% confidence
Finding: The workflow explicitly instructs the user to fully load, scroll, and expand all comments and replies before extraction, maximizing the volume of collected data. This changes the action from limited page assistance into deliberate bulk harvesting from authenticated sessions, increasing privacy and platform-abuse concerns.

Ssd 3

High

Confidence: 99% confidence
Finding: The documented workflow directs the agent to run extraction scripts against open browser pages and then deliver the generated spreadsheet, operationalizing data exfiltration from the browser into a portable file. In context, this is not merely descriptive text; it is a concrete end-to-end procedure for harvesting and transferring authenticated page data.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.