Security audit

Bb Browser Skill

Security checks for vulnerabilities and agentic risk

Overview

This skill is not clearly malicious, but it gives an agent broad access to your real logged-in browser and private web account data without enough scoping or safeguards.

Install only if you are comfortable letting an agent operate through a real browser profile. Use a dedicated Chrome/Chromium profile with no unrelated logins or saved credentials, approve each target site and private resource explicitly, avoid eval and network capture unless narrowly needed, and verify the bb-browser binary, daemon, and extension from a trusted source before use.

A.I.G

Vulnerability Patterns

Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T05 · Unauthorized Access and Privilege Escalation

Error

Location: SKILL.md:5
Finding: Excessive Access to Authenticated Browser Sessions
Content: View full analysis
--json bb-browser site twitter/user --json bb-browser site twitter/thread --json ``` ### 小红书 (Xiaohongshu) ```bash bb-browser site xiaohongshu/search '东京旅游' --json bb-browser site xiaohongshu/feed --json bb-browser site xiaohongshu/note --json bb-browser site xiaohongshu/me --json bb-browser site xiaohongshu/user_posts --json ``` > Note: Requires logged-in XHS session in Chromium. ``` ```markdown ### Bilibili ```bash bb-browser site bilibili/search 'Claude AI' --json bb-browser site bilibili/trending --json bb-browser site bilibili/popular --json bb-browser site bilibili/feed --json bb-browser site bilibili/history --json ``` ``` ```markdown ## Browser Direct Control For sites without adapters, use raw CDP commands: ```bash bb-browser open # Open URL in current tab bb-browser open --tab # Open in new tab bb-browser snapshot -i # Screenshot + page snapshot bb-browser tab # List open tabs bb-browser tab # ...[truncated 3007 chars]
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: SKILL.md:7
Finding: Unverifiable Host-Mounted Browser Automation Component
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill explicitly states it operates against a real Chromium instance with real cookies and authenticated sessions, but it does not present a strong, prominent warning about the privacy and account-security implications. In an agent setting, this can lead users or downstream skills to access or expose private logged-in data from sites like Twitter, Xiaohongshu, Bilibili, and others without informed consent or clear guardrails.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: Documenting network traffic capture without a privacy warning is dangerous because captured requests may include authentication tokens, session identifiers, personal data, search history, and other sensitive metadata from the active logged-in browser. Given this skill's direct attachment to a real host browser, the risk is elevated beyond normal web automation because interception applies to genuine user traffic rather than an isolated sandbox.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.