Security audit
Security checks for vulnerabilities and agentic risk
This browser automation skill is not malicious, but it asks for broad control over sensitive web actions with some unsafe default behaviors that users should review carefully.
Install only if you are comfortable giving the skill broad browser control. Before using it for email, social posting, registrations, uploads, private pages, payments, or forms, require explicit per-action confirmation and avoid letting it auto-confirm dialogs, capture sensitive screenshots, or clear cookies without consent.
Defaulting browser dialog handling to 'confirm' is dangerous because dialogs often gate destructive or irreversible actions such as form submission, deletion, navigation away from unsaved work, permission grants, or security prompts. An attacker-controlled page or even a normal site workflow could cause the agent to authorize harmful actions without meaningful user review.
The trigger list is broad and maps to common user intents like opening websites, searching the web, filling forms, sending email, and registering accounts. This increases the chance of unintended activation for sensitive browser-mediated actions, which can lead to account actions, data disclosure, or external posting without sufficiently explicit user intent.
The trigger conditions are so broad that the skill may auto-activate for almost any web-related task, including sensitive flows like account registration, email access, social posting, and data entry. Overbroad invocation increases the chance of unintended browser actions, unnecessary exposure of page contents, and execution of high-impact operations without tighter scoping or contextual confirmation.
L112 states that the skill will automatically clear browser cache and cookies after handling user privacy data, but the rest of the document provides no execution step, tool usage, or example showing any cache/cookie-clearing action. This is a documentation-to-behavior contradiction because the skill claims a concrete cleanup behavior that is not actually described as being performed by the skill's operational flow.
Automatically clearing browser cache and cookies after privacy-related operations can log users out, remove session state, and potentially destroy data the user expected to retain. Without a prior warning and consent step, this creates a safety and integrity risk because the skill can perform destructive session cleanup as a side effect of otherwise routine browsing tasks.
Automatically providing screenshots of key steps and summarizing posted content or links can expose sensitive page contents, personal data, account details, private messages, or unpublished content. Because the skill is intended for broad browser use cases including email, social media, and form filling, this behavior materially increases the risk of unintended data disclosure.
The package description presents the skill as suitable for nearly all browser tasks, including form filling, social posting, and data extraction, without defining when it should or should not activate. Overbroad capability framing can cause the agent to select this skill in ambiguous situations involving sensitive user data or authenticated sessions.
The manifest advertises sensitive actions such as social-media posting, form completion, email access, and data extraction, but does not warn about privacy, credential, account, or irreversible action risks. In this context, missing safety disclosures make misuse more dangerous because browser automation often operates in authenticated sessions and can act on behalf of the user.
The output specification provides fixed Chinese-language user-facing messages and does not indicate that the response language should follow user preference. This can violate language or locale policy where users should be allowed to choose or inherit their preferred language.
The manifest uses only Chinese descriptions and trigger phrases, with no indication that language selection is optional or that the skill is intentionally limited to a Chinese-language audience. This can be a natural-language policy concern when a skill appears to assume a single language without explicit opt-in or documented regional justification.
No suspicious patterns detected.
