chrome-bookmark-folder-summarizer

• Outcome: Pass
• Latest audit: Sep 11, 2026 · 10:26 PM UTC
• Version: 1.0.1

Overview

This skill does what it says: it reads a user-selected Chrome bookmark folder, extracts URLs, and asks the agent to summarize those pages, with privacy and URL-safety considerations users should understand.

Install only if you are comfortable letting the agent read your Chrome bookmarks for a named folder and fetch those bookmarked pages. Prefer reviewing the extracted URL list first, avoid folders containing private intranet or authenticated links unless intended, and treat webpage content as untrusted during summarization.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/extract_chrome_bookmarks.py:70
• Finding: Unvalidated Bookmark URLs Can Reach Downstream Fetch Operations## Vulnerability Details **File Location**: `scripts/extract_chrome_bookmarks.py:70-75`; downstream behavior specified in `SKILL.md:47-49` **Vulnerability Type**: Server-Side Request Forgery and unsafe URL scheme handling **Risk Level**: Medium **Vulnerable code in `scripts/extract_chrome_bookmarks.py`:** ```python if node.get("type") == "url": collected.append( { "title": node.get("name", "").strip(), "url": node.get("url", "").strip(), } ) ``` **Downstream instruction in `SKILL.md`:** ```markdown 4. Batch webpage summarization - Fetch page content for each URL (prefer full body text; fall back to title + short description on failure) - Recommended output structure: ``` ### Technical Analysis The extraction script copies bookmark URL values into its JSON output without validating their scheme, hostname, resolved address, port, or redirect destination. The documented workflow then directs the Agent to fetch every extracted URL. Because bookmark files can contain arbitrary URL strings, a malicious or compromised bookmark may identify loopback services, private-network systems, link-local cloud metadata endpoints, local files, or unsupported non-HTTP schemes. The precise exploitability depends on the downstream fetch tool and its own network and scheme restrictions. If that tool permits such destinations, the workflow creates a server-side request forgery path. ### Attack Path 1. An attacker adds a crafted URL to the target Chrome bookmark folder, or persuades the user to import a malicious bookmark set. 2. The user asks the Skill to summarize that folder. 3. `collect_urls()` copies the crafted value into `results[].urls[]` without validation. 4. The Agent follows `SKILL.md` and submits the URL to its webpage-fetching tool. 5. If the fetch tool permits the destination, it accesses an internal service, loopback endpoint, link-local metadata service, ...[truncated 652 chars]
• Remediation: ## Remediation Suggestions - Parse each URL before returning or fetching it and allow only explicitly supported schemes, preferably `https` and, where necessary, `http`. - Reject URLs containing embedded credentials and reject unsupported, malformed, or ambiguous hostnames. - Resolve hostnames and block loopback, private, link-local, multicast, unspecified, reserved, and cloud-metadata address ranges for both IPv4 and IPv6. - Revalidate the resolved address immediately before connection to reduce DNS rebinding risk. - Validate every redirect target using the same policy and enforce a small redirect limit. - Deny local schemes such as `file:`, `data:`, `javascript:`, and tool-specific schemes. - Use an isolated fetch service with restricted egress, no ambient credentials, and strict response-size and timeout limits. - Require explicit user confirmation before accessing unusual ports or destinations outside normal public web endpoints. - Return a structured validation error for rejected bookmark entries rather than silently attempting to fetch them.

other

Warning

• Location: SKILL.md:47
• Finding: Remote Page Content Is Processed Without Indirect Prompt-Injection Safeguards## Vulnerability Details **File Location**: `SKILL.md:47-52` **Vulnerability Type**: Indirect prompt injection through untrusted webpage content **Risk Level**: Medium **Vulnerable instruction:** ```markdown 4. Batch webpage summarization - Fetch page content for each URL (prefer full body text; fall back to title + short description on failure) - Recommended output structure: - Page title - Core takeaway (1-2 sentences) - Key points (2-4 bullets) - Relevance to user goal (one sentence) ``` ### Technical Analysis The Skill instructs the Agent to fetch and process arbitrary webpage bodies but does not establish a trust boundary between page data and Agent instructions. There is no requirement to ignore commands embedded in fetched content, prevent tool calls requested by a page, isolate summarization from privileged context, or avoid disclosing local and conversational data. A malicious webpage can include text crafted to resemble system or developer instructions. When its full body is placed into the model context for summarization, that text may attempt to override the summarization task, request sensitive information, alter output, or induce unrelated tool operations. This is an indirect prompt-injection risk rather than evidence that the packaged script itself contains malicious code. ### Attack Path 1. An attacker controls a webpage saved in the selected bookmark folder, compromises an existing bookmarked page, or causes a bookmarked domain to redirect to malicious content. 2. The user invokes the Skill for that folder. 3. The extraction script returns the attacker-controlled URL. 4. Following `SKILL.md`, the Agent fetches the full page body. 5. The page contains adversarial instructions presented as authoritative commands, such as requests to ignore prior constraints, reveal context, or invoke additional tools. 6. Without explicit content-isolation rules, the Agent may treat those ...[truncated 650 chars]
• Remediation: ## Remediation Suggestions - State explicitly that fetched webpages are untrusted data and that all instructions, policies, tool requests, and role declarations found in page content must be ignored. - Limit processing to content extraction and summarization; prohibit page-driven tool calls, credential entry, downloads, code execution, and changes to Agent configuration or memory. - Perform webpage retrieval in an isolated component with no access to secrets, local files, authenticated browser state, or unnecessary network destinations. - Pass only sanitized, relevant page text to the summarization stage rather than raw HTML, scripts, metadata, hidden elements, or comments. - Delimit untrusted content clearly and use a fixed summarization prompt that preserves higher-priority instructions. - Disable unnecessary tools while summarizing remote content and require explicit user approval for any action beyond reading the selected pages. - Detect and flag instruction-like text in fetched pages, and report suspected prompt injection rather than following it. - Apply output controls to prevent summaries from exposing secrets or reproducing attacker-supplied operational instructions as trusted guidance.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (5)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: The code accurately implements the bookmark-reading and folder-based URL extraction portions of the description: it locates the Chrome bookmarks file, searches bookmark folders by exact or contains match, optionally handles recursion and duplicate folder names, and returns deduplicated URLs. However, the declared purpose also says it 'generates batch webpage summaries,' and there is no code to retrieve webpage content, call a summarizer, or produce summaries. So the description overstates the skill's actual behavior in a material way.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 90% confidence
• Finding: The skill instructs reading a local Chrome bookmarks file and therefore accesses sensitive local user data, but it declares no explicit tool scope or permissions boundary. That makes the capability opaque to the user and increases the chance of unintended or over-broad file access when the skill is invoked.

Vague Triggers

Medium

• Confidence: 87% confidence
• Finding: Broad trigger phrases like references to bookmarks, favorites, or saved links can cause the skill to activate in situations where the user did not clearly consent to local data access or URL fetching. In this context, unintended invocation is more dangerous because the skill reads private local bookmark data and may subsequently fetch external sites derived from that data.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The description does not warn users that the skill will read a local Chrome bookmarks database and then fetch bookmarked URLs, both of which have privacy implications. This omission undermines informed consent and may expose browsing interests, internal links, or sensitive saved resources through local access and network requests.

Vague Triggers

Low

• Confidence: 82% confidence
• Finding: The invocation guidance is permissive and lacks clear constraints about when the skill should and should not run. Because the skill touches local bookmark data, weak trigger discipline can lead to accidental privacy-impacting actions even if the core functionality is legitimate.

Static analysis

No suspicious patterns detected.