T08 · Insecure Dependencies
Error
- Location
SKILL.md:13- Finding
Unpinned Third-Party CLI Executes with Access to Authenticated Browser State
- Content
View full analysis
- Remediation
View remediation
Security audit
Neo — Web App API Discovery
Security checks for vulnerabilities and agentic risk
Overview
This skill is a powerful browser automation tool that is mostly purpose-aligned, but it can use real logged-in browser sessions, export cookies, capture traffic, replay requests, and install an unpinned third-party CLI.
Review before installing. Use this only with a dedicated Chrome profile containing accounts and data needed for the task, not a primary browser profile. Avoid cookie export/import unless you explicitly need it, treat exported cookies as credentials, and require manual review before any POST, replay, cookie clear, or authenticated API action. Prefer a pinned, audited Neo CLI version before trusting it with active sessions.
Vulnerability Patterns
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)
T05 · Unauthorized Access and Privilege Escalation
Error
- Location
SKILL.md:92- Finding
Browser Cookie Export and Automatic Authentication Expose Reusable Session Credentials
- Content
View full analysis
[--body '{}'] # Smart call (schema + auto-auth) neo exec [--method POST] [--body] [--tab pattern] [--auto-headers] neo replay [--tab pattern] # Replay captured call ``` ### Technical Analysis The skill explicitly permits bulk cookie inspection, plaintext cookie export, cookie import, and persistence of login sessions across browser restarts. It also performs API requests using authentication automatically inherited from the browser. Session cookies commonly function as bearer credentials. A party possessing an exported cookie may be able to impersonate the user without knowing the account password, subject to website-specific controls. Saving these credentials to a predictable JSON file also moves them outside the browser's normal protected storage and creates an additional theft, backup, logging, and accidental-disclosure surface. Automatically adding browser authentication to API requests further creates a confused-deputy ...[truncated 1967 chars]- Remediation
View remediation
T05 · Unauthorized Access and Privilege Escalation
Error
- Location
SKILL.md:150- Finding
Broad Chrome Profile Enumeration and Authenticated Traffic Capture Enable Request Replay
- Content
View full analysis
# Search by URL pattern neo capture domains # Domains with counts neo capture detail # Full capture details ``` The related replay capability is defined at lines 165–168: ```bash # API Execution neo api [--body '{}'] # Smart call (schema + auto-auth) neo exec [--method POST] [--body] [--tab pattern] [--auto-headers] neo replay [--tab pattern] # Replay captured call ``` ### Technical Analysis The skill can enumerate all discovered Chrome profiles and associated email addresses, select a real profile, record CDP network traffic, inspect complete request details, and replay captured requests. Browser network requests may contain cookies, authorization headers, CSRF tokens, personal data, API request bodies, private responses, and identifiers. Full traffic capture therefore crosses a sensitive access boundary, especially when connected to the user's normal browser profile rather than an isolated automation profile. The combination of capture and replay is particularly risky. A captured state-changing request may be repeated under the user's authenticated session. If capture scope is not limited to a specifi ...[truncated 1701 chars]- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Memory PoisoningPersistent Context Injection, Context Window Stuffing, Memory Manipulation
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (5)
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill description is so broad that it can intercept a large share of generic web, API, browsing, scraping, and social-media tasks. In an agent system, that increases the chance this powerful skill is invoked by default for requests that may not require browser automation, authenticated API access, or session-bearing actions, expanding attack surface and raising the risk of unintended side effects.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The skill states that API calls can be made with automatic browser-derived authentication and CSRF context, but it does not warn that this sends authenticated requests on the user's behalf. In practice, this can trigger state-changing actions such as posting, purchasing, deleting, or account modification against live services if the skill is invoked on an authenticated tab.
- Content
Context Window Stuffing
Medium
- Category
- Memory Poisoning
- Confidence
- 85% confidence
- Finding
Skill attempts to fill the context window with filler content, displacing legitimate instructions and safety constraints. This can degrade agent performance or bypass safety boundaries.
- Content
md neo doctor neo snapshot # Get a11y tree with compact ref IDs neo click 14 # Click element by ref number neo fill 7 "search query" # Clear + fill input neo type 7 "text" # Append text neo press Enter neo scroll down 500
Context Window Stuffing
Medium
- Category
- Memory Poisoning
- Confidence
- 85% confidence
- Finding
Skill attempts to fill the context window with filler content, displacing legitimate instructions and safety constraints. This can degrade agent performance or bypass safety boundaries.
- Content
md neo doctor neo snapshot # Get a11y tree with compact ref IDs neo click 14 # Click element by ref number neo fill 7 "search query" # Clear + fill input neo type 7 "text" # Append text neo press Enter neo scroll down 500
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill explicitly documents exporting, importing, and clearing cookies, including persisting login sessions across browser restarts, but does not warn that cookies are sensitive authentication material. This can enable session theft, account takeover, privacy breaches, or destructive logout/state loss if an agent uses these commands without clear user consent and secure handling.
- Content
Static analysis
No suspicious patterns detected.