T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/session_manager.py:31- Finding
Persistent Authenticated Browser Profiles Lack Explicit Filesystem Protection
- Content
View full analysis
- Remediation
View remediation
Security audit
Clean Skill
Security checks for vulnerabilities and agentic risk
Overview
The skill mostly matches its restaurant-checking purpose, but it can store logged-in browser sessions locally and its default fetchers can return mock data despite live-data wording.
Review before installing. Use it only if you are comfortable with scraping Dianping/Xiaohongshu and possibly saving logged-in browser cookies under a local sessions directory. Treat default results as potentially synthetic unless using the real scraper path, run in an isolated environment, and do not share or commit the sessions directory.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)
T08 · Insecure Dependencies
Note
- Location
scripts/requirements.txt:4- Finding
Unpinned and Unverified Third-Party Dependencies Create Supply-Chain Exposure
- Content
View full analysis
=2.31.0 beautifulsoup4>=4.12.0 lxml>=4.9.0 # Browser automation (for real data fetching) playwright>=1.40.0 # Data processing pandas>=2.0.0 numpy>=1.24.0 # Fuzzy matching thefuzz>=0.3.1 # HTTP requests with retries urllib3>=2.0.0 ``` The documentation separately recommends an unconstrained and inconsistent installation command: ```bash pip install requests beautifulsoup4 pandas numpy thefuzz selenium lxml ``` ### Technical Analysis Every declared dependency uses an open-ended minimum version rather than an exact reviewed version. No lock file or package hash is supplied. As a result, two installations performed at different times can resolve to materially different dependency sets without any change to the Skill repository. The documentation also instructs users to install Selenium even though the reviewed real-data implementation uses Playwright and `scripts/requirements.txt` does not list Selenium. This unnecessary package expands the dependency surface and makes the documented environment inconsistent with the declared environment. The repository contains no evidence that any currently named dependency is malicious. The risk arises because future releases satisfying these broad ranges can be selected automatically without repository-level review or integrity validation. ### Attack Path 1. A user follows `SKILL.md` or installs `scripts/requirements.txt`. 2. The package installer resolves the newest available versions satisfying the open-ended constraints. 3. A future compromised, malicious, or otherwise unsafe release is selected, or package-index/DNS/TLS trust is compromised outside the repository. 4. Installation hooks, imported package cod ...[truncated 1065 chars]- Remediation
View remediation
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (47)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
Interactive browser automation for login plus persistent session storage and expiry tracking are materially sensitive behaviors omitted from the high-level description. This is dangerous because it can lead to unanticipated handling of credentials, cookies, and local session artifacts, exposing users to token leakage or overprivileged automation if the environment is shared or compromised.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
Interactive browser automation for login plus persistent session storage and expiry tracking are materially sensitive behaviors omitted from the high-level description. This is dangerous because it can lead to unanticipated handling of credentials, cookies, and local session artifacts, exposing users to token leakage or overprivileged automation if the environment is shared or compromised.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
Interactive browser automation for login plus persistent session storage and expiry tracking are materially sensitive behaviors omitted from the high-level description. This is dangerous because it can lead to unanticipated handling of credentials, cookies, and local session artifacts, exposing users to token leakage or overprivileged automation if the environment is shared or compromised.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
Interactive browser automation for login plus persistent session storage and expiry tracking are materially sensitive behaviors omitted from the high-level description. This is dangerous because it can lead to unanticipated handling of credentials, cookies, and local session artifacts, exposing users to token leakage or overprivileged automation if the environment is shared or compromised.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
Interactive browser automation for login plus persistent session storage and expiry tracking are materially sensitive behaviors omitted from the high-level description. This is dangerous because it can lead to unanticipated handling of credentials, cookies, and local session artifacts, exposing users to token leakage or overprivileged automation if the environment is shared or compromised.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
Interactive browser automation for login plus persistent session storage and expiry tracking are materially sensitive behaviors omitted from the high-level description. This is dangerous because it can lead to unanticipated handling of credentials, cookies, and local session artifacts, exposing users to token leakage or overprivileged automation if the environment is shared or compromised.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
Interactive browser automation for login plus persistent session storage and expiry tracking are materially sensitive behaviors omitted from the high-level description. This is dangerous because it can lead to unanticipated handling of credentials, cookies, and local session artifacts, exposing users to token leakage or overprivileged automation if the environment is shared or compromised.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 88% confidence
- Finding
Interactive browser automation for login plus persistent session storage and expiry tracking are materially sensitive behaviors omitted from the high-level description. This is dangerous because it can lead to unanticipated handling of credentials, cookies, and local session artifacts, exposing users to token leakage or overprivileged automation if the environment is shared or compromised.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
Interactive browser automation for login plus persistent session storage and expiry tracking are materially sensitive behaviors omitted from the high-level description. This is dangerous because it can lead to unanticipated handling of credentials, cookies, and local session artifacts, exposing users to token leakage or overprivileged automation if the environment is shared or compromised.
- Content
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md See [scripts/requirements.txt](scripts/requirements.txt) for complete list.
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 90% confidence
- Finding
The skill documentation describes capabilities that require network access, local file access, and likely session/cookie storage, but it does not declare an explicit tool scope or permissions boundary. This creates an authorization and transparency gap: an agent or reviewer cannot easily tell what external actions the skill may perform, increasing the risk of overbroad execution and unintended data access.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The skill relies on web scraping, cookies, and residential proxies against third-party platforms, but this is not surfaced as a prominent user warning in the main description. That omission is dangerous because users may unknowingly authorize collection methods involving authenticated sessions, proxy routing, and potential legal/privacy risks that materially change the trust profile of the skill.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 83% confidence
- Finding
The document is entirely scoped to Chinese-language Xiaohongshu content, keywords, and Chinese-specific NLP libraries, but it does not state that this locale restriction is optional or justified as a region-specific skill. Under the policy, language or locale constraints should either offer user choice or be clearly documented as intentional and justified.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
This code emits user-facing text exclusively in Chinese, including labels such as "高/中/低" and the formatted recommendation output. That creates a language-policy issue because the skill forces a specific locale without any visible opt-in, fallback, or justification that it is intended only for a Chinese-speaking context.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The script's user-facing CLI text is written exclusively in Chinese, including status messages and usage guidance. This imposes a specific language on users without opt-in or explanation, which matches the natural-language locale policy violation criteria.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The docstring claims this is a server-friendly cross-check using requests and BeautifulSoup, but the code performs no scraping and does not use those libraries. This deceptive description increases the chance that operators or agents rely on the module for real-world verification when it only emits synthetic data.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The skill metadata promises automatic fetching and cross-referencing of live Xiaohongshu and Dianping data, but this implementation only fabricates mock restaurants and posts. In an agent setting, this can mislead users and downstream systems into trusting invented recommendations as validated external intelligence, creating integrity and trust risks.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The request headers hard-code
Accept-Languageto preferzh-CN, which imposes a specific locale policy on all requests. The file does not offer user opt-in or configuration for locale selection, and no region-specific justification is documented in the code.- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The request header hard-codes 'Accept-Language' to 'zh-CN,zh;q=0.9', which imposes a specific language/locale behavior. The file does not offer user opt-in or configuration for locale selection, and no region-specific justification is documented in the code.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The search method’s name, docstring, and surrounding behavior imply a real cross-platform search, but the implementation explicitly uses simulated data. Because this skill is supposed to validate restaurant quality across platforms, simulated Xiaohongshu results undermine the core security property of data trustworthiness and can produce false confidence scores or incorrect recommendations.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The exported convenience function is presented as fetching Xiaohongshu data, but it ultimately returns fabricated mock records rather than data from the platform. In this skill’s context, that can mislead downstream recommendation or trust-scoring logic into treating synthetic data as real evidence, causing integrity failures and potentially deceptive outputs to users.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The scraper launches a persistent Playwright browser context tied to a reused session directory, which can silently reuse authentication state, cookies, and other browsing artifacts across runs. In an agent skill that performs network actions automatically, this creates privacy and authorization risks because requests may be made under a prior logged-in identity without explicit user awareness or consent.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The manifest describes a skill that fetches ratings/review counts from Xiaohongshu and Dianping to validate restaurant recommendations. This file instead provides a standalone browser session manager that opens login flows, persists authenticated browser profiles, and maintains login state across runs, which is a materially broader capability than recommendation cross-checking itself.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The code creates session directories and writes session_state.json to disk, persisting login metadata outside the user-visible restaurant-analysis function. In a skill described as recommendation cross-checking, undocumented local state changes increase privacy and transparency risk because users may not expect durable browser profile storage and session reuse.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
Session state is persisted to disk without an explicit user-facing notice that login persistence data and browser profiles will be stored locally. Because the skill handles authenticated access to third-party services, lack of clear disclosure creates privacy and consent issues and may lead users to unknowingly leave reusable sessions on disk.
- Content
Static analysis
No suspicious patterns detected.