agentcookie-install

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The skill instructs the operator to read pairing.json (containing a pairing code and pair_url) and then place those secret values verbatim into a pairing command, which requires the LLM/agent to handle and reproduce secrets directly.

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.70). These are downloads of prebuilt agentcookie binaries from a GitHub user's releases page (potential supply‑chain risk — prebuilt executables from a single/unknown repo should be treated as suspicious until verified); the localhost JSON endpoints are benign probes and not a download risk.

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 1.00). This skill explicitly transfers Chrome session cookies from a "source" machine to a "sink" over the network (Tailscale), enables live CDP injection into a remote browser, and instructs creating an empty blocklist (sync-all), all of which intentionally enable credential/session exfiltration and remote session hijacking by agents.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill runs curl/go install at runtime to fetch and install binaries from GitHub (e.g., https://github.com/mvanhorn/agentcookie/releases/download/v1.0.0/agentcookie_1.0.0_darwin_arm64.tar.gz and https://github.com/mvanhorn/agentcookie/releases/download/v1.0.0/agentcookie_1.0.0_linux_amd64.tar.gz and the go install github.com/mvanhorn/agentcookie/cmd/agentcookie@v1.0.0 line), which downloads and executes remote code required for the skill to work.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 1.00). The prompt explicitly instructs using sudo to move the agent binary into /usr/local/bin and to install a persistent service (systemd unit), which requires elevated privileges and modifies the host system state.