ClawHub
Back to skill

Security audit

Xiaopi Chrome Devtools

Security checks for vulnerabilities and agentic risk

Overview

The skill does what it says, but its runtime setup automatically runs an unpinned npm package and launches Chrome with sandbox protections disabled.

Review this before installing. Prefer a version that pins chrome-devtools-mcp to a reviewed exact version and does not disable Chrome sandboxing, or run it only inside a dedicated low-privilege container/VM with a temporary browser profile and no sensitive logged-in sessions.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T08 · Insecure Dependencies

Error
Location
skill.json:4
Finding

Automatic Execution of an Unpinned npm Package

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Error
Location
skill.json:8
Finding

Chrome Sandbox Protections Explicitly Disabled

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Rp1

Medium
Category
MCP Rug Pull
Confidence
96% confidence
Finding

The skill instructs use of npx chrome-devtools-mcp@latest --help, which relies on a floating package version rather than a pinned, audited release. That creates a supply-chain risk: future package updates or a compromised publish could change behavior and execute unreviewed code in the user's environment when they follow the guidance.

Content

No source excerpt is available for this finding.