T09 · Insecure Skill Coding Practices
Warning
- Location
skills.md:22- Finding
Unscoped Forced Termination of All Chrome Processes
- Content
View full analysis
nul'); ``` ### Technical Analysis The action forcefully terminates every process whose image name is `chrome.exe`. It does not verify whether a process was created by this Skill, belongs to the intended debugging profile, contains unsaved user activity, or is performing another workload. The `/f` option forces termination rather than requesting a graceful shutdown. Global process termination is not necessary merely to launch a separate Chrome instance with a dedicated debugging profile. Although the command is static and does not expose command injection, it violates least-impact process-management practices. ### Attack Path 1. A user or automation workflow invokes the `launch_chrome_9222` action. 2. The action executes `taskkill /f /im chrome.exe`. 3. Windows identifies all processes using the `chrome.exe` image name. 4. Every matching process accessible to the Skill's security context is forcibly terminated. 5. Existing browser sessions, downloads, automation jobs, or unsaved activity are interrupted before the debugging instance starts. No external attacker-controlled input is required; the harmful behavior occurs whenever the action is invoked. ### Impact Assessment The impact is primarily local availability and potential loss of unsaved browser state. The command can terminate all Chrome processes that the account running the Skill has permission to terminate. It does not independently grant additional privileges, but execution under an elevated account could expand the set of affected processes. ]]>- Remediation
View remediation