Security audit

Huo15 Js Scraper

Security checks for vulnerabilities and agentic risk

Overview

This scraping skill is mostly aligned with its stated purpose, but it asks users to load an unaudited external skill and handles local credentials and file writes too loosely.

Review before installing. Use it only in an isolated environment or virtualenv, avoid --break-system-packages, do not load the external GitHub skill unless you separately trust and review it, and treat the saved Qichacha cookie file as a session credential that should be protected or deleted after use.

A.I.G

Vulnerability Patterns

Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions

Findings (4)

T03 · Remote Payload Retrieval and Execution

Error

Location: SKILL.md:137
Finding: Mutable Third-Party Skill Loaded from an External Repository
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/qichacha_scraper.py:38
Finding: Reusable Authentication Cookies Stored Without Enforced Access Controls
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/wecom_docs_scraper.py:229
Finding: User-Controlled Category Path Allows Writes Outside the Knowledge-Base Directory
Content: View full analysis
:"/\\|?*]', '_', title) file_path = category_dir / f"{safe_title}.md" # Markdown content construction omitted because it does not alter the path. with open(file_path, 'w', encoding='utf-8') as f: f.write(md_content) print(f" ✅ {title}") return True ``` ### Technical Analysis The `--category` argument is joined to `OUTPUT_DIR` without validation. Python's `pathlib` does not automatically confine joined paths beneath the base directory: - An absolute category path can replace the intended base path. - A category containing `..` components can traverse to parent directories. - The code creates the resulting directories and writes the output using the invoking user's permissions. Although the title is filtered for several filename metacharacters, that filtering does not constrain `ca ...[truncated 1609 chars]
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: SKILL.md:236
Finding: Unpinned Dependencies Installed into the Host Python Environment
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (11)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 94% confidence
Finding: The skill claims broad dual-engine generic scraping and anti-bot capability, but the described implementation appears narrower and domain-specific, especially around Enterprise WeChat docs. Such over-claiming is a security concern because it obscures the real operational boundary of the skill and can mislead reviewers into granting broader trust or access than the implementation actually needs.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 94% confidence
Finding: The skill claims broad dual-engine generic scraping and anti-bot capability, but the described implementation appears narrower and domain-specific, especially around Enterprise WeChat docs. Such over-claiming is a security concern because it obscures the real operational boundary of the skill and can mislead reviewers into granting broader trust or access than the implementation actually needs.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 95% confidence
Finding: The skill documents capabilities that involve network access, reading local files, and writing local files, but it does not declare an explicit tool scope such as permissions or allowed-tools. In an agent environment, missing scope declarations increases the chance of over-broad execution and makes it harder for operators to understand or constrain what the skill may do.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The skill instructs users to save authenticated Qichacha cookies to a local file for later reuse, but it does not prominently warn that these cookies are sensitive session credentials. If the file is exposed through weak filesystem permissions, backups, logs, or other local compromise, an attacker may hijack the authenticated session and access account-linked data.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The script persists authenticated Qichacha session cookies to a predictable file under the user's home directory without warning the user, setting restrictive file permissions, encrypting the contents, or limiting lifetime. Anyone with local access to the account, backups, synced dotfiles/cache data, or another process running as the same user could reuse those cookies to hijack the authenticated session and access account-scoped data.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The module docstrings and user-facing argument descriptions are written only in Chinese, which imposes a locale/language choice without opt-in or explanation. The policy requires either offering language choice or clearly documenting a justified region-specific constraint.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 84% confidence
Finding: This code initiates outbound browser-based network requests to arbitrary user-supplied URLs via Playwright, but provides no confirmation prompt and no explicit user-facing warning beyond the generic tool description. For code-file warning checks, external network access that may transmit system/browser metadata should be disclosed unless clearly communicated to the user.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The manifest/module documentation says the tool supports "stealth模式", and the CLI exposes a --stealth flag at L078. However, the parsed flag is never referenced afterward, and scrape_with_playwright is always called without any stealth-related configuration, so the documentation and exposed interface imply behavior that the code does not implement.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 81% confidence
Finding: The natural-language instructions throughout the file force a single language/locale without any opt-in or alternative. Under the stated policy, a skill should not impose a specific language unless it explicitly offers choice or documents a justified locale constraint.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 95% confidence
Finding: This file embeds its primary documentation, CLI descriptions, and interaction prompts in Chinese only, which imposes a specific language on users. The policy allows locale constraints only when documented and justified or when users are offered a choice, neither of which appears here.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The script writes scraped documents and a generated README into a fixed location under the user's home directory without prominently warning the operator in CLI help or requiring explicit confirmation. In an agent-skill context, this can unexpectedly create or overwrite local knowledge-base files, which is risky because the scraped content is remote-controlled and file creation happens automatically.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.