ziniao-webdriver-doc

• Outcome: Review
• Latest audit: Sep 15, 2026 · 1:36 AM UTC
• Version: 1.0.0

Overview

This is a documentation-only skill, but it gives under-warned guidance for controlling browser sessions with credentials, cache deletion, remote access, unsafe Linux launch flags, and downloaded executables.

Review carefully before installing. Use this only for Ziniao WebDriver work, keep the HTTP service bound to 127.0.0.1, do not expose the port to a LAN or the internet, avoid logging or hardcoding company/username/password values, verify any ChromeDriver binary before execution, and treat cache-clearing, exit, and force-kill commands as disruptive operations that should be confirmed and scoped first.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (4)

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: reference/startup-params.md:21

Finding

Remote Plaintext Control Exposes Destructive Unauthenticated Operations

Content

View full analysis

Vulnerability Details

File Location: reference/startup-params.md:21-29, reference/api-auxiliary.md:33-76
Vulnerability Type: Externally reachable management service with missing authentication and transport security
Risk Level: High

Vulnerable Code Snippet

The startup configuration permits the management service to listen on a non-loopback address:

text

--listen_ip=IP

The auxiliary API exposes process termination without credentials:

json

{
  "action": "exit",
  "requestId": "globally unique identifier"
}

It also exposes local cache deletion without requiring login. The documented behavior states that an empty browserOauths array deletes all local caches:

json

{
  "action": "ClearCache",
  "browserOauths": [],
  "requestId": "globally unique identifier"
}

Technical Analysis

The browser management interface uses unencrypted HTTP. The optional listening-address parameter allows the interface to be bound beyond 127.0.0.1, while operations such as exit and ClearCache do not require credentials.

Binding this service to a network-accessible interface therefore changes locally trusted administrative operations into remotely accessible operations without adding authentication, authorization, request integrity, or transport encryption. An empty cache target additionally has destructive wildcard semantics, increasing the effect of a single unauthenticated request.

Other documented API calls transmit the company name, username, and password in JSON. When remote access is enabled, those credentials travel over plaintext HTTP and may be exposed to network observers or an active man-in-the-middle attacker.

Attack Path

1. An operator launches the client with --listen_ip set to a reachable interface.
2. The selected port is exposed through the host firewall, local network, container mapping, or cloud security group.
3. An attacker scans the re ...[truncated 1150 chars]

Remediation

View remediation

Remediation Suggestions

1. Keep the service bound exclusively to 127.0.0.1 by default and reject non-loopback bindings unless an explicit secure remote-access mode is configured.
2. Require strong authentication and per-operation authorization for every API, including exit, ClearCache, logout, and information-query operations.
3. Replace plaintext HTTP with TLS. Prefer mutual TLS or a mutually authenticated local tunnel for remote administration.
4. Use short-lived scoped tokens rather than repeatedly transmitting account passwords.
5. Reject empty cache target arrays by default. Require an explicit allProfiles flag and a separate confirmation token for global deletion.
6. Apply host firewall rules that restrict the management port to specifically approved source addresses.
7. Add replay protection, request timestamps, cryptographically random request identifiers, rate limiting, and security event logging.
8. Clearly document that direct exposure to a LAN or the public Internet is unsupported and unsafe.

T09 · Insecure Skill Coding Practices

Warning

• Location: reference/prerequisites.md:31

Finding

Mandatory Fuzzy Process Termination Can Kill Unrelated Processes

Content

View full analysis

Vulnerability Details

File Location: reference/prerequisites.md:31-46, SKILL.md:113-126
Vulnerability Type: Overbroad process matching and forced termination
Risk Level: Medium

Vulnerable Code Snippet

powershell

Get-Process | Where-Object { $_.ProcessName -match 'ziniao|ZiNiao' } | Stop-Process -Force

bash

pkill -f ziniao || true

Technical Analysis

Both cleanup commands identify targets through substring or regular-expression matching rather than a verified process identifier and executable path.

On Unix-like systems, pkill -f matches the entire command line. Any unrelated process whose arguments contain ziniao can therefore be terminated. The PowerShell command similarly applies a broad case-pattern match and then invokes forced termination. Neither command validates executable ownership, installation path, parent process, start time, or whether the process belongs to the current automation run.

The use of Stop-Process -Force and unconditional cleanup before startup or retry eliminates graceful shutdown behavior. Active processes may be terminated before they flush files, persist cookies, release locks, or complete transactions.

Attack Path

1. A legitimate application or attacker-controlled process starts with ziniao in its process name or command-line arguments.
2. An operator follows the documented mandatory cleanup procedure before startup or retry.
3. The broad matching expression selects both the intended browser processes and the unrelated process.
4. The command forcibly terminates every matching process.
5. The unrelated application loses availability and may leave data, lock files, or transactions in an inconsistent state.

Impact Assessment

The commands execute with the invoking user's privileges and can terminate any matching process that user is permitted to signal. If run from an elevated shell, the scope expands to processes owned by othe ...[truncated 357 chars]

Remediation

View remediation

Remediation Suggestions

1. Record the exact PID returned when the browser client is launched and terminate only that PID and its verified child processes.
2. Before sending a signal, verify the process executable path, owner, parent PID, and process start time.
3. Use the documented exit API or an ordinary termination signal first, allowing the client to save state and close gracefully.
4. Apply force termination only after a bounded grace period and only to verified client processes.
5. Store PID files in a user-private directory and protect them against symbolic-link and replacement attacks.
6. Avoid recommending elevated execution for routine cleanup.
7. If discovery is unavoidable, compare canonical executable paths against a strict allowlist rather than matching command-line substrings.

T09 · Insecure Skill Coding Practices

Error

• Location: reference/startup-params.md:50

Finding

Linux Browser Launch Disables the Chromium Sandbox

Content

View full analysis

Vulnerability Details

File Location: reference/startup-params.md:50-69, reference/startup-params.md:94-113
Vulnerability Type: Browser sandbox disabled by insecure launch configuration
Risk Level: High

Vulnerable Code Snippet

Python example:

python

cmd = [client_path, '--no-sandbox',
       '--run_type=web_driver',
       '--ipc_type=http',
       '--port=' + str(socket_port)]

JavaScript example:

javascript

const cmd = [clientPath, '--no-sandbox',
    '--run_type=web_driver',
    '--ipc_type=http',
    `--port=${socketPort}`];
execFile(cmd[0], cmd.slice(1));

Technical Analysis

Chromium's sandbox is a defense-in-depth boundary intended to restrict compromised renderer and browser subprocesses. Passing --no-sandbox explicitly disables this protection.

Browser automation routinely processes untrusted web content, scripts, downloads, media, and third-party extensions. A browser or renderer vulnerability that would otherwise be constrained by the sandbox may consequently access files, credentials, processes, and network resources available to the browser's operating-system account.

The examples present the flag as a normal Linux requirement without constraining execution to a hardened container or warning against running as root. This encourages unsafe deployment on general-purpose hosts.

Attack Path

1. An operator launches the browser on Linux using the provided example.
2. The client starts Chromium with --no-sandbox.
3. An automated store session visits attacker-controlled or compromised web content.
4. The content exploits a browser, renderer, extension, or media-processing vulnerability.
5. Because the Chromium sandbox is disabled, the exploit gains direct access to resources available to the browser's operating-system account.
6. The attacker reads or modifies accessible files, steals session material, invokes local programs, or connects to in ...[truncated 525 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove --no-sandbox from the standard Linux launch examples.
2. Install and configure the Chromium sandbox prerequisites, including supported user namespaces and required kernel features.
3. Run the browser as a dedicated unprivileged operating-system user with no interactive credentials.
4. If sandbox disabling is unavoidable, isolate the process in a hardened rootless container or virtual machine.
5. In that isolated environment, remove Linux capabilities, enable no-new-privileges, use a read-only root filesystem, restrict mounts, and apply seccomp and mandatory access-control policies.
6. Limit outbound and internal network access to required destinations.
7. Never run the browser as root, and add an explicit startup check that rejects root execution.
8. Document the security consequences of sandbox removal prominently rather than presenting it as a routine platform requirement.

T08 · Insecure Dependencies

Error

• Location: reference/framework-examples.md:89

Finding

Downloaded ChromeDriver Executable Is Trusted Without Integrity Verification

Content

View full analysis

Vulnerability Details

File Location: reference/framework-examples.md:89-140
Vulnerability Type: Unverified remote executable download and cache reuse
Risk Level: High

Vulnerable Code Snippet

python

resp = requests.get(
    "https://googlechromelabs.github.io/chrome-for-testing/known-good-versions-with-downloads.json"
)
resp.encoding = "utf-8"
data = resp.json()

python

zip_resp = requests.get(download_url)
with zipfile.ZipFile(io.BytesIO(zip_resp.content)) as zf:
    for name in zf.namelist():
        if name.endswith(exe_name):
            with open(cached, "wb") as f:
                f.write(zf.read(name))
            break

if platform.system() != "Windows":
    os.chmod(cached, 0o755)

return cached

Existing cached binaries are returned without validation:

python

if os.path.exists(cached):
    return cached

Technical Analysis

The helper obtains mutable metadata from a remote endpoint, selects a download URL, downloads an archive, extracts an executable, marks it executable, caches it, and returns its path for later execution. It performs no cryptographic checksum or signature verification.

HTTPS protects data in transit under ordinary conditions, but it does not protect against a compromised upstream account, compromised distribution infrastructure, malicious metadata, an incorrectly trusted certificate authority, or local cache replacement. The code also chooses the latest matching major version rather than pinning an exact reviewed version.

Existing cache entries are trusted solely because a path exists. A local process able to write to the relative cache directory can replace the driver before the next automation run. The extraction logic additionally lacks archive-size limits, expected-path validation, atomic writes, secure directory permissions, and a check that the expected executable was actually extracted.

Attack Path

Remote ...[truncated 1413 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin an exact ChromeDriver version and an approved download URL rather than automatically choosing the latest matching major version.
2. Verify an official SHA-256 digest or cryptographic signature before extracting or executing the artifact.
3. Store expected hashes in a reviewed, version-controlled manifest obtained through an independent trusted channel.
4. Validate cached binaries on every reuse instead of trusting path existence.
5. Restrict redirects and final download hosts to an explicit allowlist.
6. Set connection and read timeouts, maximum response sizes, and archive extraction limits.
7. Create the cache under a user-private absolute directory with restrictive permissions.
8. Download to a newly created temporary file, verify it, and atomically rename it into the cache.
9. Reject symbolic links, unexpected archive paths, duplicate executable entries, and archives that do not contain exactly one expected driver.
10. Run the downloaded driver under a dedicated low-privilege account or isolated execution environment.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (12)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The document states that remote control can be enabled via --listen_ip but does not warn that binding beyond localhost may expose the local browser control HTTP API to other hosts. Because the API can start browser sessions and uses credentials in requests, exposing it remotely increases the risk of unauthorized access, credential interception on untrusted networks, and abuse of automated browser control.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill includes forceful process-kill commands that match broad process names and instructs users to run them before restart. In a documentation skill, this can cause unintended termination of unrelated processes with similar names and potential data loss, especially because the guidance lacks an explicit warning to verify targets or save work first.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

This markdown documents a cache-clearing operation and notes that an empty browserOauths value will delete all local cache, but it does not clearly warn about the potential impact on user data, session state, or reversibility. For markdown files, destructive behaviors that can affect user data or system state should include an explicit warning.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The ClearOnline API can clear all online cache or selectively retain cookies, which implies potentially significant effects on browser/session state. The section describes parameter values but does not provide a clear user-facing warning about the consequences of choosing broader deletion modes.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The documentation shows credential-bearing requests containing company, username, and password sent to an HTTP endpoint on 127.0.0.1 without any warning about the security implications. Although loopback traffic is local, plaintext secrets may still be exposed to local malware, browser extensions, debuggers, proxy tooling, or logs, and the skill context encourages integration planning that could normalize unsafe handling of account credentials.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The document instructs users to replace automation examples with company, username, and password values, but gives no guidance on secure credential handling. In practice this can encourage hardcoding secrets into scripts, sample files, or source control, increasing the risk of credential leakage and account compromise.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The manifest positions this skill as documentation for understanding capabilities, architecture, and integration planning, and explicitly says not to use it for concrete automation script writing. However, this file provides ready-to-run Selenium examples and Python pseudocode that downloads, caches, and prepares ChromeDriver binaries, which goes beyond conceptual documentation into implementation guidance for script execution.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 81% confidence

Finding

The exit section states that exiting the client will automatically close started shop windows, which affects active user workflows and system state. Although the behavior is mentioned, it is described functionally rather than as a cautionary warning, and there is no explicit notice to save work or expect interruption.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 71% confidence

Finding

The startBrowser API documents forceDownloadPath as an absolute file download path and returns downloadPath, indicating the skill can affect where files are written on the system. The markdown does not warn users that downloads may be redirected to a specified path or that this can affect local data storage.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

All instructional text in the file is presented in Chinese, and the document does not indicate that this language choice is optional or region-specific. Under the stated policy, forcing a specific language without user opt-in is a natural-language policy concern.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 85% confidence

Finding

Lines L114-L116 explicitly tell users to prefer the Chinese err field and ensure UTF-8 decoding so Chinese messages are readable. This imposes a language expectation in the skill documentation without user opt-in or an explicit statement that the skill is intentionally Chinese-only or region-specific.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

该 markdown 文件的标题、说明和示例注释全部使用中文，没有为用户提供语言/locale 选择，也未说明这是面向特定中文用户群体的受限文档。根据规则，强制特定语言且无用户 opt-in 属于自然语言策略违规。

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.