cn-browser-automation

• Outcome: Review
• Latest audit: Aug 6, 2026 · 8:44 AM UTC
• Version: 1.0.0

Overview

This skill is disclosed browser automation, but it gives broad access to logged-in Chrome sessions and account-visible data without tight runtime boundaries.

Install only if you intentionally want an agent to use a logged-in Chrome profile for these sites. Prefer a dedicated Chrome profile with only the needed accounts, review each target URL and extraction script, avoid using it for financial, identity, order, private-message, or business-admin pages unless strictly necessary, and do not run arbitrary JavaScript from untrusted sources.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (12)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 94% confidence
• Finding: The skill advertises and instructs use of shell execution, network access, and file export while declaring no permissions, which creates a transparency and consent gap for a capability set that can launch Chrome, connect to a live browser debugging port, navigate arbitrary sites, and write scraped data to disk. In the context of reusing an authenticated local browser session, these undeclared capabilities are especially sensitive because they can access account-scoped data and persist exported results without an explicit permission model or user warning at the skill boundary.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 90% confidence
• Finding: The documented behavior is broader than the stated purpose: it supports arbitrary URL navigation and arbitrary page JavaScript execution, and can launch a separate browser profile, which goes beyond a narrowly scoped 'reuse my logged-in domestic-site browser session' automation tool. This mismatch is dangerous because users may believe they are invoking a limited authenticated-session helper, while the skill actually provides a more general browser-control and data-exfiltration surface that can interact with any reachable site and evaluate attacker-chosen JS in a privileged logged-in context.

Description-Behavior Mismatch

Medium

• Confidence: 90% confidence
• Finding: Although the script advertises Bilibili ranking scraping as unauthenticated, it is wired to the shared cn_browser scraping helper with CDP attachment and persistent profile support. In the context of this skill, that means a nominally public-data scraper can still access and reuse an existing logged-in Chrome session, increasing the chance of unnecessary cookie/session exposure or accidental authenticated actions if the helper is reused broadly.

Intent-Code Divergence

Medium

• Confidence: 87% confidence
• Finding: The help text says the scraper is '免登录', but the implementation still accepts a remote debugging port, can launch Chrome, and persists a user-data-dir that may contain active sessions. That mismatch is dangerous because it can mislead users and downstream agents into believing no authentication state is involved, when the script may in fact operate with preserved cookies and account context.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The skill description emphasizes reusing the user's real Chrome login state and exporting data, but does not provide a clear up-front warning that cookies, authenticated session context, and account-visible content may be accessed and written out. In this context, the omission is materially risky because the whole value proposition is operating inside a live authenticated browser session, which can expose private messages, account dashboards, order history, or other sensitive data if the user does not understand the consequences.

Vague Triggers

Medium

• Confidence: 89% confidence
• Finding: The trigger phrase at line 13 is broad enough to match common user language around browsing or account use, which can cause this high-risk skill to activate unexpectedly. Because the skill is specifically designed to reuse an existing authenticated Chrome session, accidental invocation could route ordinary requests into account-protected automation flows without clear user intent.

Vague Triggers

Medium

• Confidence: 91% confidence
• Finding: The trigger at line 14 is too generic and likely to collide with normal speech, increasing the chance that the skill activates when a user did not intend to grant access to an already logged-in browser profile. In this skill's context, such activation is more dangerous than usual because it enables operations against authenticated sessions and protected data.

Vague Triggers

Medium

• Confidence: 87% confidence
• Finding: The manifest defines multiple permissive triggers but does not include clear boundaries, exclusions, or consent gates for when this skill should not run. Given that the skill targets reuse of active login sessions and cookies, missing trigger constraints materially increases the risk of unauthorized or surprising access to sensitive account data.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The documentation explicitly promotes reusing a real Chrome login session and authenticated scraping across multiple consumer platforms, but it does not present a prominent, consolidated warning about privacy, account compromise, cookie/session exposure, or the risk of operating on behalf of the user. Because the skill is designed to act with existing authenticated state, misuse or misunderstanding could lead to unauthorized data access, unintended account actions, or leakage of sensitive personal/business information.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The code explicitly connects to the user's existing Chrome session over CDP, reuses an authenticated browser context, navigates to arbitrary URLs, and executes arbitrary JavaScript to extract data. In this skill's context, that means any caller can access session-backed content from domestic websites without any explicit consent gate, domain allowlist, or warning, creating a strong risk of unauthorized scraping, account-data exfiltration, and actions performed under the user's identity.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The script attaches to a locally logged-in Chrome session over CDP, opens arbitrary user-supplied URLs, and can execute arbitrary JavaScript in that authenticated browser context without an execution-time consent gate. In this skill context, that is especially dangerous because the advertised purpose is operating authenticated Chinese sites and exporting data with preserved cookies/session state, which can enable sensitive account actions or data extraction if invoked on untrusted targets or with unsafe JS.

Ssd 3

High

• Confidence: 98% confidence
• Finding: The manifest explicitly instructs reuse of the operator's existing logged-in Chrome session via CDP and cookie-preserving access to account-protected sites. This is dangerous because it enables the skill to inherit live authentication state and perform scraping or actions as the user, exposing sensitive data and creating a pathway for unauthorized account operations if invoked improperly or abused.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.