T09 · Insecure Skill Coding Practices
- Location
references/api-discovery.md:214- Finding
Broad Enumeration Exposes Browser Session Secrets
- Content
View full analysis
Vulnerability Details
File Location:
references/api-discovery.md, lines 214–232
Vulnerability Type: Excessive disclosure of authentication material
Risk Level: MediumVulnerable Code
bash opencli browser eval "document.cookie.split('; ').reduce((o,x)=>{const[k,v]=x.split('=');o[k]=v;return o},{})"bash opencli browser eval "Object.keys(localStorage).map(k=>k+' => '+localStorage.getItem(k).slice(0,50))"Technical Analysis
The API-discovery workflow instructs the Agent to print every script-readable cookie and the first 50 characters of every
localStoragevalue. This is broader than necessary to determine whether a particular endpoint requires a known cookie, CSRF token, JWT, or other authentication value.An authenticated page may store unrelated session credentials, bearer tokens, account identifiers, or application secrets in these locations. Returning those values through
opencli browser evalplaces them in Agent-visible tool output and potentially in conversation histories, diagnostic traces, terminal logs, or other retained artifacts.The cookie command does not expose
HttpOnlycookies, but it exposes all non-HttpOnlycookie values without filtering. The storage command truncates values but can still reveal complete short secrets or security-sensitive token prefixes.No evidence shows that these secrets are transmitted to an attacker-controlled destination. The issue is unnecessary secret disclosure rather than confirmed network exfiltration.
Attack Path
- A user invokes the Skill while using an authenticated browser session.
- Endpoint replay returns an authentication-related error, causing the Agent to enter the token-discovery workflow.
- The Agent executes the documented cookie or
localStorageenumeration command. - All accessible cookie values or storage-value prefixes are returned in tool output.
- Unrelated authentication material becomes available in Agent context and may be retaine ...[truncated 761 chars]
- Remediation
View remediation
Remediation Suggestions
- Enumerate cookie and storage names only during initial discovery:
bash opencli browser eval "document.cookie.split('; ').map(x=>x.split('=')[0])"bash opencli browser eval "Object.keys(localStorage)" - Retrieve a value only after identifying the exact key required by the observed endpoint.
- Redact values by default, showing only metadata such as presence and length.
- Never print bearer tokens, session cookies, JWTs, or CSRF values into Agent output.
- Require explicit user confirmation before inspecting authentication-storage values.
- Ensure traces and command logs apply secret redaction and use short retention periods.
- Prefer a dedicated helper that returns only the selected key directly to the request-building operation without exposing the value to conversational output.
- Enumerate cookie and storage names only during initial discovery: