Xiaopi Chrome Devtools

• Outcome: Review
• Latest audit: Sep 16, 2026 · 3:36 AM UTC
• Version: 1.0.0

Overview

The skill does what it says, but its runtime setup automatically runs an unpinned npm package and launches Chrome with sandbox protections disabled.

Review this before installing. Prefer a version that pins chrome-devtools-mcp to a reviewed exact version and does not disable Chrome sandboxing, or run it only inside a dedicated low-privilege container/VM with a temporary browser profile and no sensitive logged-in sessions.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Error

• Location: skill.json:4
• Finding: Automatic Execution of an Unpinned npm Package<![CDATA[ ## Vulnerability Details **File Location**: `skill.json`, lines 4–7 **Vulnerability Type**: Unpinned third-party dependency execution **Risk Level**: High ### Vulnerable Code ```json "command": "npx", "args": [ "-y", "chrome-devtools-mcp@latest", ``` ### Technical Analysis The skill invokes `npx` with the `-y` option and identifies the dependency through the mutable `latest` distribution tag. This causes npm to obtain and execute the currently published version of `chrome-devtools-mcp` without an interactive confirmation step. Because `latest` does not identify an immutable, previously reviewed release, the effective code executed by the skill can change after this package has been audited. A compromised package publication, compromised maintainer account, or unsafe future release could consequently introduce arbitrary code into the skill's execution path. ### Attack Path 1. An attacker compromises the upstream package, its publishing credentials, or the release process. 2. The attacker publishes a modified version and assigns it to the `latest` npm tag. 3. A user or agent invokes this skill. 4. `npx -y` resolves and downloads the attacker-controlled release without requesting confirmation. 5. The downloaded package executes with the permissions and accessible resources of the account running the skill. ### Impact Assessment A malicious upstream release could execute arbitrary code with the privileges of the agent process. Depending on the runtime environment, it could access readable files, environment variables, browser-profile data, network resources, and other credentials available to that account. No evidence shows that the currently referenced package performs these malicious actions; the vulnerability is the mutable and automatically executed dependency path. ]]>
• Remediation: <![CDATA[ ## Remediation Suggestions - Replace `chrome-devtools-mcp@latest` with an exact, reviewed version such as `chrome-devtools-mcp@x.y.z`. - Review each dependency update before changing the pinned version. - Use a lockfile and npm integrity metadata where the deployment model permits them. - Prefer installing dependencies during a controlled build stage rather than downloading executable code when the skill is invoked. - Remove automatic confirmation through `-y` where interactive approval is operationally possible. - Run the MCP server under a dedicated, non-privileged account or isolated container with only the filesystem and network access required for browser debugging. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: skill.json:8
• Finding: Chrome Sandbox Protections Explicitly Disabled<![CDATA[ ## Vulnerability Details **File Location**: `skill.json`, lines 8–9 **Vulnerability Type**: Unsafe browser security configuration **Risk Level**: High ### Vulnerable Code ```json "--chrome-arg=--no-sandbox", "--chrome-arg=--disable-setuid-sandbox" ``` ### Technical Analysis The configuration passes both `--no-sandbox` and `--disable-setuid-sandbox` to Chrome. These switches disable browser containment defenses designed to restrict compromised renderer processes and reduce their access to the host. This is especially significant for a browser-automation skill because its intended operations include navigating to and interacting with web content that may be untrusted. The flags are not required by the documented debugging functionality itself and materially weaken defense in depth if a malicious page exploits a Chrome vulnerability. ### Attack Path 1. The skill starts Chrome with its sandbox protections disabled. 2. The browser navigates to an attacker-controlled or compromised website. 3. The page triggers a browser vulnerability capable of code execution in a renderer or another browser process. 4. Because the sandbox is disabled, the resulting code is not subject to the normal Chrome sandbox boundary. 5. The attacker may obtain access to resources available to the Chrome process and its operating-system account. Successful exploitation still requires an applicable browser vulnerability; the flags do not independently provide code execution. They substantially increase the potential impact of such an exploit. ### Impact Assessment If a browser exploit succeeds, disabling the sandbox may allow the compromised process to access host files, browser-profile information, session data, and network resources available to the user running Chrome. The maximum scope remains bounded by the operating-system privileges and external isolation applied to that user or container. ]]>
• Remediation: <![CDATA[ ## Remediation Suggestions - Remove both `--chrome-arg=--no-sandbox` and `--chrome-arg=--disable-setuid-sandbox`. - Configure the runtime so Chrome's supported sandbox can operate normally. - Run Chrome as a dedicated non-root user with minimal filesystem permissions. - If sandboxing cannot be enabled in the target environment, place the entire browser and MCP server inside a dedicated container or virtual machine. - In that isolated environment, drop unnecessary Linux capabilities, prevent privilege escalation, use a read-only root filesystem where practical, mount only required directories, and restrict network access. - Use a temporary or task-specific browser profile when persistence is not required, and avoid exposing sensitive authenticated sessions to untrusted pages. - Document and obtain explicit approval for any environment where browser sandboxing must remain disabled. ]]>

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 96% confidence
• Finding: The skill instructs use of `npx chrome-devtools-mcp@latest --help`, which relies on a floating package version rather than a pinned, audited release. That creates a supply-chain risk: future package updates or a compromised publish could change behavior and execute unreviewed code in the user's environment when they follow the guidance.

Static analysis

No suspicious patterns detected.