Security findings 8
Credential access
criticalContextual riskmedium confidenceOn first use of a site the program automatically copies that site's session cookies from the user's Chrome into the tool's own dedicated-browser profile without per-copy confirmation; the copy is explicitly scoped to one site and stored locally, but it is a real credential-access capability over the user's browser session store.
程序把该站的登录（只限该站 Cookie）复制一次到专用浏览器
trigger:conditionalvector:codevector:instructionvector:mixed
Counter-argument considered
The one-time automatic copy of a site's cookies from the user's Chrome into the tool's own profile runs without per-copy confirmation, and the agent-triggered `--import-existing` re-copy (flagged as contradicting the declared read-only claims) is a genuine credential-access capability; single-site scoping limits severity but does not remove it.
Code execution
highContextual riskmedium confidenceMaintenance instructions direct the agent to run `agent-reach browser setup`, which downloads and installs a browser kernel and browser extension (retried via `browser setup --retry-cloak` for 'CloakBrowser'), staging and executing fetched binaries on the host from undisclosed sources.
准备内核和扩展，`browser stop` 关闭；CloakBrowser 下载失败后修好网络可 `browser setup --retry-cloak`
vector:instruction
Counter-argument considered
`browser setup` stages and launches a downloaded CloakBrowser kernel and extension; no unit names the download source, and the local-Chrome fallback applies only when the download fails, so fetched binaries execute on success — a fetch-and-execute chain no carve-out covers.
Code execution
highContextual risklow confidenceSKILL.md instructs the agent to run `agent-reach add <channel>`, which auto-installs dependencies (Node, OpenCLI, browser kernel, extension) fetched at runtime from destinations not stated in the shown text.
`agent-reach add <渠道>` 自动准备 Node、OpenCLI、内核和扩展。
vector:instruction
Counter-argument considered
`agent-reach add` fetches Node, OpenCLI, kernel and extension at runtime; the only qualification in the units is that tools install at versions tested with the release, and no download destination is stated, so the fetch-and-execute chain remains unverifiable and no carve-out applies.
Credential access
highContextual risklow confidenceSKILL.md instructs the agent to have the user hand over a secret key and then relay it as a command-line argument to `agent-reach configure <key>`, placing the credential on the process command line where shells and process listings can expose it.
要密钥时请用户本人提供，再 `agent-reach configure <key>`
vector:instruction
Counter-argument considered
The instruction is genuine: the agent relays a user-supplied secret as a command-line argument to configure the tool, which the env-key carve-out does not cover (argv, not env) and no unit mitigates; the key is user-provided for the wrapped service itself, so this stands as a low-severity contextual risk.
Supply chain
mediumContextual risklow confidenceThe skill instructs the agent to run `agent-reach update`, which upgrades Agent Reach, the tools of added channels, and the skill itself, replacing installed code with unpinned content from an update source the units do not disclose beyond the GitHub homepage metadata.
升级 Agent Reach、已加渠道的工具和 skill
vector:instruction
Counter-argument considered
User consent gates the update, but the units name no update endpoint or pinning while `agent-reach update` replaces the tool, the channel tools and the skill itself; consent is not source verification, so the self-replacement supply chain stands.
Supply chain
mediumContextual risklow confidenceSKILL.md and maintenance.md instruct the agent to run `agent-reach add`, `browser setup` and `agent-reach update`, which auto-download and install Node, OpenCLI, the CloakBrowser kernel and a browser extension and self-update the tool and skill from sources absent from the repository, so endpoints and version pinning cannot be verified by any reviewer.
自动准备 Node、OpenCLI、内核和扩展
vector:instruction
Counter-argument considered
Across add, browser setup and update the units never state an endpoint or a verifiable pin, while the commands download Node, OpenCLI, the CloakBrowser kernel and an extension and replace the tool and skill themselves, so neither agent nor reviewer can verify what executes; the consolidated supply finding stands.
Supply chain
mediumContextual risklow confidenceThe skill instructs the agent to run `agent-reach add <channel>` in response to a user add request, where dependencies install automatically, triggering a dependency installation chain whose registry, versions, and install scripts are not disclosed in the shown units.
dependencies install automatically
vector:instruction
Counter-argument considered
Auto-install on `add` executes fetched code, and the shown units disclose no registry, version list or install scripts beyond the phrase that dependencies install automatically, so the pinned-official-registry carve-out cannot apply and the supply-chain opacity stands.
Agent hijacking
mediumContextual risklow confidenceSKILL.md directs the agent to describe upstream outages to the user without naming the tool responsible (不说工具名), shaping what the user is told about the cause of failures.
用平台名告诉用户哪个平台暂时用不了、大概是什么原因，不说工具名
vector:instruction
Counter-argument considered
The skill scripts the agent's user-facing outage explanation to name only the platform and withhold the tool, steering attribution of failures away from agent-reach; no carve-out or mitigation in the units neutralizes this narrative control, so the finding stands at low severity.
