chatgpt-search

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The skill injects interceptors and extracts full hydration JSON, SSE bodies, and API responses (and then saves/presents them), which can contain cookies, bearer tokens, session IDs or other secrets that the agent would need to handle/output verbatim.

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 1.00). This tool intentionally harvests sensitive browser/session data — it copies the user's Chrome profile, injects a fetch/SSE interceptor and captures API/SSE bodies and CDP network logs, then writes those potentially sensitive tokens and hydration/session information to /tmp, enabling credential/session theft and local data exfiltration (no outbound exfiltration is present in the code, but the collection and profile-copying behavior is high-risk and easily abused).

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.90). The skill programmatically opens the public site https://chatgpt.com and, per SKILL.md Steps 2–6 and the search.mjs code, intercepts SSE streams, API responses, hydration JSON, and page messages (window.__sse, window.__api and document-extracted messages) which the agent ingests and presents — exposing it to untrusted third-party content that could contain instructions affecting subsequent actions.