Neo — Web App API Discovery

• Outcome: Review
• Latest audit: Sep 11, 2026 · 5:47 AM UTC
• Version: 2.1.0

Overview

This skill is a powerful browser automation tool that is mostly purpose-aligned, but it can use real logged-in browser sessions, export cookies, capture traffic, replay requests, and install an unpinned third-party CLI.

Review before installing. Use this only with a dedicated Chrome profile containing accounts and data needed for the task, not a primary browser profile. Avoid cookie export/import unless you explicitly need it, treat exported cookies as credentials, and require manual review before any POST, replay, cookie clear, or authenticated API action. Prefer a pinned, audited Neo CLI version before trusting it with active sessions.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T08 · Insecure Dependencies

Error

• Location: SKILL.md:13
• Finding: Unpinned Third-Party CLI Executes with Access to Authenticated Browser State<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 13–18 **Vulnerability Type**: Unpinned executable dependency **Risk Level**: High ### Vulnerable Code ```yaml metadata: openclaw: requires: bins: [neo] install: - id: neo kind: node package: "@4ier/neo" bins: [neo] label: "Install Neo CLI (npm)" ``` ### Technical Analysis The skill installs and executes the third-party npm package `@4ier/neo` without specifying an exact version, lockfile, package integrity hash, or other immutable verification mechanism. Consequently, the code installed at deployment time can differ from the code available when the skill was reviewed. The installed CLI is subsequently given access to a real Chrome profile, authenticated browser sessions, cookies, network traffic, and page-context execution. This significantly increases the security impact of a compromised package release, registry account, dependency tree, or package installation process. The audit did not establish that `@4ier/neo` is currently malicious. The vulnerability is the mutable and unverified supply-chain trust boundary combined with the extensive privileges granted to the installed executable. ### Attack Path 1. An attacker compromises the npm package, a transitive dependency, its publisher account, or the package distribution path. 2. The attacker publishes a modified version under the same package name. 3. The skill installation resolves and installs the modified version because no exact version or integrity value is required. 4. The package's installation logic or `neo` executable runs with the permissions of the agent user. 5. The compromised executable accesses local files, browser profiles, authenticated cookies, or captured network requests exposed by the skill. 6. Sensitive data can then be modified, stolen, or used to perform authenticated actions. ### Impact Assessment Successful exploitation could provide code execution wi ...[truncated 453 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Pin `@4ier/neo` to an exact, audited version rather than relying on mutable package resolution. 2. Commit and enforce a lockfile containing verified integrity hashes. 3. Install only from an explicitly trusted registry and reject registry substitution. 4. Disable npm lifecycle scripts where operationally possible. 5. Audit the package and its complete transitive dependency tree before deployment. 6. Consider vendoring the reviewed executable source or distributing a reproducible, signed artifact. 7. Run the CLI in a sandbox with restricted filesystem and network access. 8. Do not grant the dependency access to the user's primary Chrome profile; use a dedicated browser profile containing only task-specific accounts and data. 9. Monitor dependency updates and require security review before changing the pinned version. ]]>

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: SKILL.md:92
• Finding: Browser Cookie Export and Automatic Authentication Expose Reusable Session Credentials<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 92–102; related authenticated API behavior at lines 58–61 and 165–168 **Vulnerability Type**: Excessive access to authenticated browser sessions **Risk Level**: High ### Vulnerable Code ```bash neo doctor neo schema show x.com # Check existing API knowledge neo api x.com HomeTimeline # Call it (auto-auth from browser) neo api x.com CreateTweet --body '{"variables":{"tweet_text":"hello"}}' ``` ```bash ### Cookie management ```bash neo cookies list # All cookies for active page neo cookies list github.com # Filter by domain neo cookies export github.com cookies.json # Save to file neo cookies import cookies.json # Restore cookies neo cookies clear github.com # Delete by domain neo cookies clear # Delete all ``` Use `export` + `import` to persist login sessions across browser restarts. ``` ```bash # API Execution neo api <domain> <keyword> [--body '{}'] # Smart call (schema + auto-auth) neo exec <url> [--method POST] [--body] [--tab pattern] [--auto-headers] neo replay <id> [--tab pattern] # Replay captured call ``` ### Technical Analysis The skill explicitly permits bulk cookie inspection, plaintext cookie export, cookie import, and persistence of login sessions across browser restarts. It also performs API requests using authentication automatically inherited from the browser. Session cookies commonly function as bearer credentials. A party possessing an exported cookie may be able to impersonate the user without knowing the account password, subject to website-specific controls. Saving these credentials to a predictable JSON file also moves them outside the browser's normal protected storage and creates an additional theft, backup, logging, and accidental-disclosure surface. Automatically adding browser authentication to API requests further creates a confused-deputy ...[truncated 1967 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Use a dedicated, isolated Chrome profile rather than the user's primary profile. 2. Disable unrestricted cookie listing, export, and import by default. 3. Require explicit user confirmation immediately before every cookie export and every state-changing authenticated request. 4. Restrict cookie operations to an explicitly approved domain and reject unscoped bulk operations. 5. Never print full cookie values, authorization headers, CSRF tokens, or equivalent secrets to agent output or logs. 6. If export is unavoidable, encrypt the file, use a randomly generated restricted path, set owner-only permissions, and securely delete it immediately after use. 7. Add expiry limits and prohibit using exports to persist sessions across browser restarts unless the user explicitly requests that behavior. 8. Separate read-only website access from state-changing operations and use least-privileged website accounts where possible. 9. Display the target domain, HTTP method, endpoint, and sanitized request body for confirmation before attaching authentication. 10. Implement strict destination allowlists so browser credentials cannot be attached to unrelated hosts or redirects. ]]>

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: SKILL.md:150
• Finding: Broad Chrome Profile Enumeration and Authenticated Traffic Capture Enable Request Replay<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 105–109 and 150–158 **Vulnerability Type**: Excessive browser reconnaissance and network-capture privileges **Risk Level**: High ### Vulnerable Code ```bash ### Profile management ```bash neo profile list # Discover all Chrome profiles + emails neo profile use "Default" # Set default profile neo start # Launches with selected profile ``` ``` ```bash # Capture & Traffic (no extension needed — pure CDP) neo status # Overview neo capture start # Start CDP network capture neo capture stop # Stop capture neo capture list [domain] [--limit N] # Recent captures neo capture search <query> # Search by URL pattern neo capture domains # Domains with counts neo capture detail <id> # Full capture details ``` The related replay capability is defined at lines 165–168: ```bash # API Execution neo api <domain> <keyword> [--body '{}'] # Smart call (schema + auto-auth) neo exec <url> [--method POST] [--body] [--tab pattern] [--auto-headers] neo replay <id> [--tab pattern] # Replay captured call ``` ### Technical Analysis The skill can enumerate all discovered Chrome profiles and associated email addresses, select a real profile, record CDP network traffic, inspect complete request details, and replay captured requests. Browser network requests may contain cookies, authorization headers, CSRF tokens, personal data, API request bodies, private responses, and identifiers. Full traffic capture therefore crosses a sensitive access boundary, especially when connected to the user's normal browser profile rather than an isolated automation profile. The combination of capture and replay is particularly risky. A captured state-changing request may be repeated under the user's authenticated session. If capture scope is not limited to a specifi ...[truncated 1701 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove enumeration of profile email addresses unless it is indispensable to an explicitly requested task. 2. Operate exclusively in a dedicated automation profile with no unrelated accounts or browsing history. 3. Limit capture to one explicitly approved tab, origin, and domain. 4. Stop capture automatically when the requested operation completes or navigation leaves the approved origin. 5. Redact cookies, authorization headers, CSRF tokens, query secrets, and sensitive request or response fields before storing or displaying captures. 6. Store captures only in ephemeral memory and enforce short retention periods. 7. Require explicit user approval before showing full capture details or replaying any request. 8. Block replay of non-idempotent methods such as `POST`, `PUT`, `PATCH`, and `DELETE` unless the exact request is reviewed and confirmed. 9. Add origin validation so captured authentication material cannot be replayed to a different host. 10. Maintain an audit log containing sanitized operation metadata without recording credentials or private payloads. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Memory Poisoning: Persistent Context Injection, Context Window Stuffing, Memory Manipulation
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: The skill description is so broad that it can intercept a large share of generic web, API, browsing, scraping, and social-media tasks. In an agent system, that increases the chance this powerful skill is invoked by default for requests that may not require browser automation, authenticated API access, or session-bearing actions, expanding attack surface and raising the risk of unintended side effects.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The skill states that API calls can be made with automatic browser-derived authentication and CSRF context, but it does not warn that this sends authenticated requests on the user's behalf. In practice, this can trigger state-changing actions such as posting, purchasing, deleting, or account modification against live services if the skill is invoked on an authenticated tab.

Context Window Stuffing

Medium

• Category: Memory Poisoning

Content

neo doctor
neo snapshot                  # Get a11y tree with compact ref IDs
neo click 14                  # Click element by ref number
neo fill 7 "search query"    # Clear + fill input
neo type 7 "text"             # Append text
neo press Enter
neo scroll down 500

• Confidence: 85% confidence
• Finding: Skill attempts to fill the context window with filler content, displacing legitimate instructions and safety constraints. This can degrade agent performance or bypass safety boundaries.

Context Window Stuffing

Medium

• Category: Memory Poisoning

Content

neo doctor
neo snapshot                  # Get a11y tree with compact ref IDs
neo click 14                  # Click element by ref number
neo fill 7 "search query"    # Clear + fill input
neo type 7 "text"             # Append text
neo press Enter
neo scroll down 500

• Confidence: 85% confidence
• Finding: Skill attempts to fill the context window with filler content, displacing legitimate instructions and safety constraints. This can degrade agent performance or bypass safety boundaries.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill explicitly documents exporting, importing, and clearing cookies, including persisting login sessions across browser restarts, but does not warn that cookies are sensitive authentication material. This can enable session theft, account takeover, privacy breaches, or destructive logout/state loss if an agent uses these commands without clear user consent and secure handling.

Static analysis

No suspicious patterns detected.