Security audit

Aipex Browser

Security checks for vulnerabilities and agentic risk

Overview

This browser-control skill is coherent, but it asks users to install a persistent unpinned MCP bridge with broad access to browser tabs, screenshots, form fields, downloads, and full editor contents.

Install only if you trust the AIPex extension and npm bridge publisher, and prefer pinning a reviewed bridge version instead of using unpinned `npx -y`. Avoid using this skill on sensitive tabs unless needed, confirm before screenshots are sent to an LLM, and do not let it read editors, enter passwords, or save downloads without explicit intent.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

Location: SKILL.md:50
Finding: Unpinned Third-Party npm Package Is Downloaded and Executed Automatically
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Output HandlingUnvalidated Output Injection, Cross-Context Output, Unbounded Output
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (7)

Rp1

Medium

Category: MCP Rug Pull
Confidence: 88% confidence
Finding: The skill declares use of npx to fetch and execute an MCP bridge package without pinning a specific version, which creates a supply-chain risk. A future malicious or compromised package release could be pulled automatically and executed locally with the user's privileges when the skill is set up.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 98% confidence
Finding: The setup instruction explicitly tells users to run npx -y aipex-mcp-bridge, which downloads and executes the latest published package version at runtime. This is dangerous because any compromise of the npm package, publisher account, or dependency chain could lead to arbitrary code execution on the local machine.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The skill instructs use of capture_screenshot(sendToLLM=true) but does not clearly warn that page screenshots may be transmitted to the LLM, potentially exposing sensitive on-screen information. In a browser automation context, screenshots can easily contain credentials, personal data, session details, or proprietary content, making the omission materially risky.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The skill exposes browser-wide enumeration and screenshot capabilities that can access titles, URLs, and visible contents of all open tabs, which may include sensitive personal, corporate, or authentication-related data. In an agent skill context, documenting and normalizing these capabilities without clear privacy boundaries, consent requirements, or data-minimization guidance increases the risk of over-collection and unintended exfiltration.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The form-filling examples include email and password-style values, which can normalize handling of credentials without any caution about secrets management, masking, or user consent. In a browser automation skill, this makes it easier for an agent to solicit, store, or replay sensitive authentication data in unsafe ways.
Content: No source excerpt is available for this finding.

Unbounded Output

Medium

Category: Output Handling
Confidence: 86% confidence
Finding: get_editor_value is documented to return full editor contents without truncation, which can expose large amounts of sensitive source code, secrets, proprietary text, or embedded credentials from an active browser session. In an MCP/browser-agent setting, unrestricted full-content reads create a direct data-exfiltration channel and can also increase blast radius by bypassing minimization controls.
Content: Scanner excerpt · references/tools-reference.md (reported line 172)May include surrounding context.
md
### `get_editor_value` Read the full text content of a code editor (Monaco, CodeMirror, ACE) or textarea without truncation. Call before overwriting to avoid data loss. | Parameter | Type | Required | Description | |---|---|---|---|

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 82% confidence
Finding: The skill advertises downloading content and saving data locally but does not warn users that these actions can write files to disk or alter local user data. In a browser-control skill, this can lead to unanticipated persistence of sensitive content, clutter, or overwriting/retention risks, especially when handling extracted web data.
Content: No source excerpt is available for this finding.