Chrome DevTools MCP Manager

• Outcome: Review
• Latest audit: Sep 14, 2026 · 11:12 PM UTC
• Version: 1.0.0

Overview

The skill is coherent browser-automation documentation, but it tells users to persistently run a mutable npm package with Chrome DevTools access and includes an unsafe force-kill troubleshooting command.

Review before installing. Prefer pinning chrome-devtools-mcp to a specific reviewed version instead of @latest, avoid running the MCP client with elevated privileges, use a dedicated browser profile without unrelated sensitive sessions, and do not run the Stop-Process -Force troubleshooting command unless you have verified the process is the intended Chrome instance and are prepared to terminate it.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Error

• Location: SKILL.md:134
• Finding: Unpinned npm Package Is Executed Through Persistent MCP Configuration## Vulnerability Details **File Location**: `SKILL.md`, lines 134–159 **Vulnerability Type**: Unpinned third-party dependency execution **Risk Level**: High The skill instructs users to execute the mutable `latest` release of `chrome-devtools-mcp` through `npx` and place the same command in persistent MCP client configuration. ```bash # Add MCP server to mcporter mcporter server add chrome-devtools \ --command "npx" \ --args "chrome-devtools-mcp@latest,--browserUrl,http://127.0.0.1:18800,--no-usage-statistics" # Or with auto-connect (Chrome will be started if not running) mcporter server add chrome-devtools \ --command "npx" \ --args "chrome-devtools-mcp@latest,--autoConnect,--no-usage-statistics" ``` ```json { "mcpServers": { "chrome-devtools": { "command": "npx", "args": [ "chrome-devtools-mcp@latest", "--browserUrl", "http://127.0.0.1:18800", "--no-usage-statistics" ] } } } ``` ### Technical Analysis The `@latest` version selector is mutable and does not identify the exact package artifact reviewed when this skill was audited. When the command is invoked, `npx` may download and execute whatever release the package registry currently identifies as the latest version. The persistent MCP configuration increases exposure because an MCP client may execute the command repeatedly in future sessions. If the package maintainer account, registry publication process, or a future release is compromised, the effective executable payload can change without any modification to this skill. The configured service also connects to a browser debugging endpoint. A malicious dependency could therefore combine its local process privileges with access to the active browser session. ### Attack Path 1. An attacker compromises the upstream package, maintainer account, or release pipeline, or a malicious future version is published. 2. The compro ...[truncated 1339 chars]
• Remediation: ## Remediation Suggestions 1. Replace `chrome-devtools-mcp@latest` with an exact, reviewed version, such as `chrome-devtools-mcp@X.Y.Z`. 2. Use a project lockfile and a deterministic installation workflow where the MCP client supports them. 3. Verify npm package provenance, publisher identity, and integrity metadata before installation. 4. Prefer a preinstalled, reviewed executable over allowing the MCP client to download packages automatically during startup. 5. Disable automatic dependency updates and introduce a controlled update process that includes source review, vulnerability scanning, and functional testing. 6. Run the MCP server under a dedicated, unprivileged account or sandbox with only the filesystem and network access required for browser automation. 7. Restrict access to the Chrome debugging endpoint and avoid connecting it to browser profiles containing unrelated sensitive sessions.

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:299
• Finding: Port-Conflict Procedure Forcefully Terminates Unverified Processes## Vulnerability Details **File Location**: `SKILL.md`, lines 299–303 **Vulnerability Type**: Unsafe process termination **Risk Level**: Medium The troubleshooting procedure passes every process associated with local port 18800 directly to `Stop-Process -Force` without validating that it is the expected Chrome process. ```powershell **Kill conflicting process:** ```powershell Get-Process -Id (Get-NetTCPConnection -LocalPort 18800).OwningProcess | Stop-Process -Force ``` ``` ### Technical Analysis A TCP port does not establish the identity or trustworthiness of its owning process. Port 18800 may be occupied by an unrelated legitimate service, a process containing unsaved state, or a process deliberately placed there by another local user or program. `Stop-Process -Force` does not request graceful shutdown. The command also does not verify the executable path, process name, command line, owner, expected parent process, or whether the listener belongs to the OpenClaw-managed Chrome instance. If multiple matching connections exist, the pipeline may attempt to terminate multiple processes. ### Attack Path 1. A legitimate unrelated service, or an attacker-controlled local process, binds to port 18800. 2. Chrome or the MCP integration reports a port conflict. 3. The user follows the documented troubleshooting procedure. 4. The command obtains the owning process ID solely from the port association. 5. `Stop-Process -Force` immediately terminates that process without identity validation or confirmation. 6. The terminated process may lose in-memory state, interrupt a service, or leave partially written data. ### Impact Assessment Exploitation or accidental invocation can cause denial of service for any process occupying port 18800. The affected scope is limited by the permissions of the user executing PowerShell: the command can terminate processes that account is authorized to stop. Potential consequences include in ...[truncated 331 chars]
• Remediation: ## Remediation Suggestions 1. Treat port inspection and process termination as separate steps. 2. Display the process ID, name, executable path, owner, command line, and listening endpoint before taking action. 3. Verify that the process is the expected OpenClaw-managed Chrome instance rather than relying only on its port. 4. Require explicit user confirmation before termination. 5. Use the documented browser-management operation to stop Chrome gracefully whenever possible: ```javascript browser({ action: "stop", profile: "openclaw" }) ``` 6. Attempt ordinary process termination before using `-Force`; reserve forced termination for a verified, unresponsive target. 7. Avoid running the troubleshooting command from an elevated shell unless elevated access is demonstrably required. 8. Handle multiple listeners explicitly rather than piping all returned process IDs into a termination command.

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Memory Poisoning: Persistent Context Injection, Context Window Stuffing, Memory Manipulation
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (4)

Context Window Stuffing

Medium

• Category: Memory Poisoning

Content

### Interaction
- `click` - Click element by uid
- `fill` - Fill input field
- `type_text` - Type text
- `press_key` - Press keyboard key
- `select_option` - Select dropdown option

• Confidence: 85% confidence
• Finding: Skill attempts to fill the context window with filler content, displacing legitimate instructions and safety constraints. This can degrade agent performance or bypass safety boundaries.

Context-Inappropriate Capability

Medium

• Confidence: 92% confidence
• Finding: The documented remediation uses `Stop-Process -Force` on whatever process owns port 18800, without verifying that it is actually the intended built-in Chrome instance. In a shared or misconfigured environment, this can terminate unrelated local software, causing data loss or service disruption beyond the scope of the skill.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: This command is destructive because it forcibly kills the process bound to the port and is presented as routine troubleshooting without a clear safety warning. Users may execute it blindly, terminating the wrong process and interrupting unrelated applications or losing unsaved work.

Natural-Language Policy Violations

Low

• Confidence: 82% confidence
• Finding: The example uses Chinese text (`查询内容`) as the input payload, which implicitly biases the skill toward a specific language in its natural-language guidance. There is no indication that the skill is region-specific or that users may substitute their own preferred language.

Static analysis

No suspicious patterns detected.