Security audit

Agent Browser Skill

Security checks for vulnerabilities and agentic risk

Overview

The skill is a browser automation helper, but its included script can execute crafted browser arguments through the local shell and can log sensitive form or URL data.

Install only if you trust the skill author and will use it with controlled inputs. Avoid passing untrusted URLs, selectors, output paths, option names, or form data to the helper script until it replaces shell execution with argument-array process execution and stops logging raw command values.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Error

Location: scripts/browser-automation.js:28
Finding: OS Command Injection Through Shell-Interpolated Browser Arguments
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/browser-automation.js:42
Finding: Sensitive Browser and Form Arguments Exposed in Process Logs
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Behavioral ASTexec() Call, eval() Call, Dynamic Import
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (3)

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: This method builds a shell command by concatenating untrusted argument values and then executes it via child_process.exec, which invokes a shell. Double-quoted string interpolation does not safely prevent shell metacharacter expansion such as command substitution, so attacker-controlled values can lead to arbitrary OS command execution and unintended network/data exposure.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 83% confidence
Finding: This code exposes operations such as taking screenshots to an output path and later page actions like clicking and form filling, but the user-facing CLI help only lists commands and does not warn that the script may write files or perform browser interactions on the user's behalf. Under the code-file criteria, these safety-relevant operations lack a confirmation prompt or explanatory warning about their impact.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 82% confidence
Finding: The docstring says this method extracts text from a page, but the implementation calls the generic 'snapshot' browser command with mode and maxChars options. That is an intent-level mismatch because the documented behavior implies text extraction while the code delegates to a snapshot operation whose semantics are different in the rest of the file.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.