ClawHub
Back to skill

Security audit

AI Orchestrator

Security checks for vulnerabilities and agentic risk

Overview

This skill mostly does what it claims, but it asks for a persistent authenticated browser daemon and has several unsafe local file and browser-control practices that need review before installation.

Install only if you are comfortable sending prompts and piped files to DeepSeek and running a local authenticated Chromium daemon. Prefer an isolated OS user or container, avoid boot persistence unless you explicitly need it, restrict permissions on .profile, .sessions, and .daemon-ws-endpoint, validate session names before use, and update the dependency tree before relying on it on a shared or sensitive machine.

A.I.G

Vulnerability Patterns
  • System PersistenceInstalls backdoors, hooks, services, or scheduled tasks that survive the run
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (4)

T06 · System Persistence

Error
Location
scripts/setup-daemon.sh:15
Finding

Boot-Persistent PM2 Browser Daemon

Content
View full analysis
/dev/null || pm2 restart deepseek-daemon echo "💾 Saving PM2 state..." pm2 save echo "🔧 Setting up startup..." pm2 startup 2>/dev/null || echo " (run 'pm2 startup' manually if needed)" ``` ### Technical Analysis The default one-command setup starts the DeepSeek browser daemon, saves its process state, and invokes PM2 startup configuration. This creates a cross-session service intended to start after system reboot. The persistent daemon maintains a Chromium profile containing DeepSeek authentication state. Boot persistence is not necessary for the Skill's basic function of submitting an individual prompt and receiving a response. Although the persistence feature is documented, placing it in the default setup path exceeds the minimum privileges and lifecycle required for normal operation. Under the Skill risk classification, installing a process that survives the initiating Skill run and can restart after reboot is system persistence. ### Attack Path 1. A user or Agent follows the documented one-command setup and runs `scripts/setup-daemon.sh`. 2. The script starts `deepseek-daemon.js` under PM2. 3. `pm2 save` records the daemon in PM2's persistent process list. 4. `pm2 startup` creates or requests creation of operating-system startup integration. 5. The authenticated browser daemon is subsequently restored across login sessions or system restarts. 6. Any later compromise of the PM2 account, browser profile, daemon endpoint, or daemon process can provide continuing access to the authenticated DeepSeek session. ### Impact Assessment The daemon runs with the privileges of the invoking OS account and retains access to: - The persistent Chromium profile and its authenticat ...[truncated 324 chars]
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Error
Location
ask-puppeteer.js:375
Finding

Session Name Path Traversal Allows Filesystem Access Outside the Session Directory

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
deepseek-daemon.js:41
Finding

Authenticated Chromium Control Endpoint Stored Without Explicit Access Restrictions

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
ask-puppeteer.js:925
Finding

Chromium Sandbox Unconditionally Disabled for Remote Web Content

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • System Prompt LeakageDirect Leakage, Indirect Extraction, Tool-Based Exfiltration
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (60)

Chaining Abuse

High
Category
Tool Misuse
Confidence
75% confidence
Finding

Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.

Content

Scanner excerpt · REFERENCE.md (reported line 153)May include surrounding context.

md
| Symptom | First action |
|---------|--------------|
| `Connection refused` / daemon dead | `pm2 restart deepseek-daemon && sleep 8` |
| Login/CAPTCHA/auth expired | `pm2 stop deepseek-daemon && rm -f .daemon-ws-endpoint && ./ask-deepseek.sh "auth" --visible --wait --dry-run && pm2 start deepseek-daemon` |
| Long answer cut off | switch to `--session` and split prompt into chunks |
| Composer timeout | run `./ask-deepseek.sh --dry-run` first |
| Chrome/profile weird state | `rm -f .profile/Singleton* && pm2 restart deepseek-daemon` |

Chaining Abuse

High
Category
Tool Misuse
Confidence
75% confidence
Finding

Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.

Content

Scanner excerpt · REFERENCE.md (reported line 186)May include surrounding context.

md
| Symptom | First action |
|---------|--------------|
| `Connection refused` / daemon dead | `pm2 restart deepseek-daemon && sleep 8` |
| Login/CAPTCHA/auth expired | `pm2 stop deepseek-daemon && rm -f .daemon-ws-endpoint && ./ask-deepseek.sh "auth" --visible --wait --dry-run && pm2 start deepseek-daemon` |
| Long answer cut off | switch to `--session` and split prompt into chunks |
| Composer timeout | run `./ask-deepseek.sh --dry-run` first |
| Chrome/profile weird state | `rm -f .profile/Singleton* && pm2 restart deepseek-daemon` |

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
85% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · REFERENCE.md (reported line 156)May include surrounding context.

md
| Login/CAPTCHA/auth expired | `pm2 stop deepseek-daemon && rm -f .daemon-ws-endpoint && ./ask-deepseek.sh "auth" --visible --wait --dry-run && pm2 start deepseek-daemon` |
| Long answer cut off | switch to `--session` and split prompt into chunks |
| Composer timeout | run `./ask-deepseek.sh --dry-run` first |
| Chrome/profile weird state | `rm -f .profile/Singleton* && pm2 restart deepseek-daemon` |

## 7. Неисправности и Решения

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
85% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · REFERENCE.md (reported line 186)May include surrounding context.

md
| Login/CAPTCHA/auth expired | `pm2 stop deepseek-daemon && rm -f .daemon-ws-endpoint && ./ask-deepseek.sh "auth" --visible --wait --dry-run && pm2 start deepseek-daemon` |
| Long answer cut off | switch to `--session` and split prompt into chunks |
| Composer timeout | run `./ask-deepseek.sh --dry-run` first |
| Chrome/profile weird state | `rm -f .profile/Singleton* && pm2 restart deepseek-daemon` |

## 7. Неисправности и Решения

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
85% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · REFERENCE.md (reported line 268)May include surrounding context.

md
- Используй `--daemon` (стабильное ~35ms подключение)
- Измеряй **сырой вывод** (stdout), не сводку subagents
- Файлы метрик: `.diagnostics/metrics-tr-<id>.json`
- Для повторных тестов: `pm2 flush && rm .diagnostics/metrics-*`

## 10. Файлы и управление

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
85% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · REFERENCE.md (reported line 278)May include surrounding context.

md
- `.daemon-ws-endpoint`, `.profile/`, `.sessions/`, `package.json`

**Можно чистить:**
- Дампы диагностики: `rm -f .diagnostics/error-*.png .diagnostics/error-*.html`
- Логи PM2: `pm2 flush`
- Сессии: `rm -f .sessions/*.json`

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
85% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · REFERENCE.md (reported line 280)May include surrounding context.

md
**Можно чистить:**
- Дампы диагностики: `rm -f .diagnostics/error-*.png .diagnostics/error-*.html`
- Логи PM2: `pm2 flush`
- Сессии: `rm -f .sessions/*.json`

## 11. Производительность (проверено 2026-04-03)

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

The declared description is about providing DeepSeek AI access through browser automation and daemon management. The supplied code does not perform any DeepSeek access, Puppeteer automation, CDP interception, health checking of a DeepSeek daemon, PM2 management, or request/response handling. Instead, it serves a separate engineering/security purpose: enforcing isolation between this skill and a sibling qwen-orchestrator skill by comparing paths and scanning source files for cross-references. This is a materially different primary purpose and includes undeclared filesystem-auditing behavior unrelated to the user-facing DeepSeek functionality.

Content

No source excerpt is available for this finding.

Chaining Abuse

High
Category
Tool Misuse
Confidence
87% confidence
Finding

The recovery command chains multiple state-changing operations with &&, including stopping a daemon, deleting state, launching visible auth flow, and restarting the daemon. Long chained remediation commands are risky in agent-operated environments because they reduce opportunities for validation between destructive steps and make partial-failure states harder to detect, which can lead to unintended state loss or unsafe recovery behavior.

Content

Scanner excerpt · SKILL.md (reported line 111)May include surrounding context.

md
| If you see this symptom | Run this exact command | Then verify with |
|---|---|---|
| `Connection refused`, `ECONNREFUSED`, daemon not online | `pm2 restart deepseek-daemon && sleep 8 && ask-deepseek.sh --dry-run --daemon` | `ask-deepseek.sh "Say OK" --daemon` |
| `auth expired`, `CAPTCHA`, login page, `401`, `403` | `cd ~/.openclaw/workspace/skills/ai-orchestrator && pm2 stop deepseek-daemon && rm -f .daemon-ws-endpoint && bash ask-deepseek.sh --visible --wait --dry-run && pm2 start deepseek-daemon` | `bash ask-deepseek.sh --dry-run --daemon` |
| response cuts off / incomplete long answer | `ask-deepseek.sh "Part 1" --session temp && ask-deepseek.sh "Continue with next part" --session temp` | `ask-deepseek.sh --session temp --end-session` |
| `lock`, `Singleton`, profile already in use | `cd ~/.openclaw/workspace/skills/ai-orchestrator && rm -f .profile/Singleton* && pm2 restart deepseek-daemon` | `bash ask-deepseek.sh --dry-run` |
| `timeout`, selector missing, composer not found | `ask-deepseek.sh --dry-run --visible` | only after manual inspection consider selector edits |

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
90% confidence
Finding

The skill instructs operators to run rm -f .profile/Singleton*, which performs file deletion using a wildcard against browser-profile lock artifacts. Even though the command is scoped to the skill directory in nearby text, wildcard deletion in operational guidance is dangerous because path confusion, symlink abuse, or incorrect working directory assumptions can turn cleanup into unintended data loss or state corruption.

Content

Scanner excerpt · SKILL.md (reported line 113)May include surrounding context.

md
| `Connection refused`, `ECONNREFUSED`, daemon not online | `pm2 restart deepseek-daemon && sleep 8 && ask-deepseek.sh --dry-run --daemon` | `ask-deepseek.sh "Say OK" --daemon` |
| `auth expired`, `CAPTCHA`, login page, `401`, `403` | `cd ~/.openclaw/workspace/skills/ai-orchestrator && pm2 stop deepseek-daemon && rm -f .daemon-ws-endpoint && bash ask-deepseek.sh --visible --wait --dry-run && pm2 start deepseek-daemon` | `bash ask-deepseek.sh --dry-run --daemon` |
| response cuts off / incomplete long answer | `ask-deepseek.sh "Part 1" --session temp && ask-deepseek.sh "Continue with next part" --session temp` | `ask-deepseek.sh --session temp --end-session` |
| `lock`, `Singleton`, profile already in use | `cd ~/.openclaw/workspace/skills/ai-orchestrator && rm -f .profile/Singleton* && pm2 restart deepseek-daemon` | `bash ask-deepseek.sh --dry-run` |
| `timeout`, selector missing, composer not found | `ask-deepseek.sh --dry-run --visible` | only after manual inspection consider selector edits |

### If 3 fixes failed already

Chaining Abuse

High
Category
Tool Misuse
Confidence
86% confidence
Finding

This command chain combines directory changes, wildcard file deletion, and daemon restart in one line. In context, the combination is more dangerous than a simple restart because it mixes destructive filesystem actions with process control, so an operator or agent following it blindly may propagate a bad state or delete unintended files before noticing an error.

Content

Scanner excerpt · SKILL.md (reported line 113)May include surrounding context.

md
| `Connection refused`, `ECONNREFUSED`, daemon not online | `pm2 restart deepseek-daemon && sleep 8 && ask-deepseek.sh --dry-run --daemon` | `ask-deepseek.sh "Say OK" --daemon` |
| `auth expired`, `CAPTCHA`, login page, `401`, `403` | `cd ~/.openclaw/workspace/skills/ai-orchestrator && pm2 stop deepseek-daemon && rm -f .daemon-ws-endpoint && bash ask-deepseek.sh --visible --wait --dry-run && pm2 start deepseek-daemon` | `bash ask-deepseek.sh --dry-run --daemon` |
| response cuts off / incomplete long answer | `ask-deepseek.sh "Part 1" --session temp && ask-deepseek.sh "Continue with next part" --session temp` | `ask-deepseek.sh --session temp --end-session` |
| `lock`, `Singleton`, profile already in use | `cd ~/.openclaw/workspace/skills/ai-orchestrator && rm -f .profile/Singleton* && pm2 restart deepseek-daemon` | `bash ask-deepseek.sh --dry-run` |
| `timeout`, selector missing, composer not found | `ask-deepseek.sh --dry-run --visible` | only after manual inspection consider selector edits |

### If 3 fixes failed already

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
95% confidence
Finding

The script deletes a file using a user-controlled session name embedded in a path without validating that the name is a safe basename. Although the variable is quoted, path traversal strings like '../' can still cause deletion of files outside the intended .sessions directory if the invoking user supplies a crafted session name.

Content

Scanner excerpt · ask-deepseek.sh (reported line 132)May include surrounding context.

sh
if [[ "$END_SESSION" = true ]]; then
  if [[ -n "$SESSION_NAME" ]]; then
    node "$SCRIPT_DIR/ask-puppeteer.js" "${SESSION_ARGS[@]}" --end-session 2>/dev/null || true
    rm -f "$SCRIPT_DIR/.sessions/${SESSION_NAME}.json"
    echo "Сессия '$SESSION_NAME' завершена"
  else
    echo "Ошибка: --end-session требует --session NAME" >&2

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
100% confidence
Finding

Although the rule matched a truncated shell fragment, the underlying command still performs destructive wildcard deletion with stderr suppressed, reducing visibility into failures or accidental overreach. Suppressing errors while deleting shared temp files makes misuse and forensic investigation harder.

Content

Scanner excerpt · ask-puppeteer.js (reported line 143)May include surrounding context.

js
await new Promise(resolve => setTimeout(resolve, 1000));
      // Очистка /dev/shm и /tmp
      try {
        execSync(`rm -rf /dev/shm/.com.google.Chrome.* 2>/dev/null || true`);
        execSync(`rm -rf /tmp/.com.google.Chrome.* 2>/dev/null || true`);
      } catch (e) {}
    }

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
95% confidence
Finding

Although the rule matched a truncated shell fragment, the underlying command still performs destructive wildcard deletion with stderr suppressed, reducing visibility into failures or accidental overreach. Suppressing errors while deleting shared temp files makes misuse and forensic investigation harder.

Content

Scanner excerpt · ask-puppeteer.js (reported line 143)May include surrounding context.

js
await new Promise(resolve => setTimeout(resolve, 1000));
      // Очистка /dev/shm и /tmp
      try {
        execSync(`rm -rf /dev/shm/.com.google.Chrome.* 2>/dev/null || true`);
        execSync(`rm -rf /tmp/.com.google.Chrome.* 2>/dev/null || true`);
      } catch (e) {}
    }

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
100% confidence
Finding

Although the rule matched a truncated shell fragment, the underlying command still performs destructive wildcard deletion with stderr suppressed, reducing visibility into failures or accidental overreach. Suppressing errors while deleting shared temp files makes misuse and forensic investigation harder.

Content

Scanner excerpt · ask-puppeteer.js (reported line 143)May include surrounding context.

js
await new Promise(resolve => setTimeout(resolve, 1000));
      // Очистка /dev/shm и /tmp
      try {
        execSync(`rm -rf /dev/shm/.com.google.Chrome.* 2>/dev/null || true`);
        execSync(`rm -rf /tmp/.com.google.Chrome.* 2>/dev/null || true`);
      } catch (e) {}
    }

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
100% confidence
Finding

This shell fragment likewise represents destructive wildcard deletion in a shared path while suppressing errors. In the context of a browser-automation daemon, that makes accidental collateral deletion more likely to go unnoticed and prolongs unsafe behavior.

Content

Scanner excerpt · ask-puppeteer.js (reported line 144)May include surrounding context.

js
// Очистка /dev/shm и /tmp
      try {
        execSync(`rm -rf /dev/shm/.com.google.Chrome.* 2>/dev/null || true`);
        execSync(`rm -rf /tmp/.com.google.Chrome.* 2>/dev/null || true`);
      } catch (e) {}
    }
  } catch (err) {

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
95% confidence
Finding

This shell fragment likewise represents destructive wildcard deletion in a shared path while suppressing errors. In the context of a browser-automation daemon, that makes accidental collateral deletion more likely to go unnoticed and prolongs unsafe behavior.

Content

Scanner excerpt · ask-puppeteer.js (reported line 144)May include surrounding context.

js
// Очистка /dev/shm и /tmp
      try {
        execSync(`rm -rf /dev/shm/.com.google.Chrome.* 2>/dev/null || true`);
        execSync(`rm -rf /tmp/.com.google.Chrome.* 2>/dev/null || true`);
      } catch (e) {}
    }
  } catch (err) {

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
100% confidence
Finding

This shell fragment likewise represents destructive wildcard deletion in a shared path while suppressing errors. In the context of a browser-automation daemon, that makes accidental collateral deletion more likely to go unnoticed and prolongs unsafe behavior.

Content

Scanner excerpt · ask-puppeteer.js (reported line 144)May include surrounding context.

js
// Очистка /dev/shm и /tmp
      try {
        execSync(`rm -rf /dev/shm/.com.google.Chrome.* 2>/dev/null || true`);
        execSync(`rm -rf /tmp/.com.google.Chrome.* 2>/dev/null || true`);
      } catch (e) {}
    }
  } catch (err) {

Direct Prompt Extraction

High
Category
System Prompt Leakage
Confidence
85% confidence
Finding

Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Content

Scanner excerpt · ask-puppeteer.js (reported line 254)May include surrounding context.

js
function ensureDirSync(d) { try { fs.mkdirSync(d, { recursive: true }); } catch {} }

function shortenPromptForRetry(prompt, attempt) {
 if (typeof prompt !== 'string') return prompt;
 const lines = prompt.split('\n');
 if (lines.length <= 6) {
   const hardMax = Math.max(OVERSIZE_RETRY_MIN_CHARS, Math.floor(prompt.length * Math.pow(OVERSIZE_RETRY_KEEP_RATIO, attempt)));

Direct Prompt Extraction

High
Category
System Prompt Leakage
Confidence
85% confidence
Finding

Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Content

Scanner excerpt · ask-puppeteer.js (reported line 258)May include surrounding context.

js
function ensureDirSync(d) { try { fs.mkdirSync(d, { recursive: true }); } catch {} }

function shortenPromptForRetry(prompt, attempt) {
 if (typeof prompt !== 'string') return prompt;
 const lines = prompt.split('\n');
 if (lines.length <= 6) {
   const hardMax = Math.max(OVERSIZE_RETRY_MIN_CHARS, Math.floor(prompt.length * Math.pow(OVERSIZE_RETRY_KEEP_RATIO, attempt)));

Known Vulnerable Dependency: basic-ftp==5.2.0 — 4 advisory(ies): GHSA-6v7q-wjvx-w8wg (basic-ftp: Incomplete CRLF Injection Protection Allows Arbitrary FTP Command Exe); CVE-2026-39983 (basic-ftp has FTP Command Injection via CRLF); CVE-2026-41324 (basic-ftp vulnerable to denial of service via unbounded memory consumption in Cl) +1 more

High
Category
Supply Chain
Confidence
91% confidence
Finding

basic-ftp 5.2.0 is a real vulnerable transitive dependency present in the lockfile. In this skill, it is pulled in through proxy/PAC handling rather than as a primary feature, so exploitability depends on attacker influence over PAC/FTP URLs or dependency code paths; if reached, command injection or DoS could affect the host running the automation daemon.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: extract-zip==2.0.1 — 2 advisory(ies): CVE-2026-19693 (extract-zip allows arbitrary file writes through symlink archive entries); CVE-2026-56876 (extract-zip unvalidated symlink path traversal)

High
Category
Supply Chain
Confidence
94% confidence
Finding

extract-zip 2.0.1 is a real vulnerable dependency and is especially relevant because Puppeteer uses browser download/extraction workflows. If an attacker can influence the downloaded archive or update source, symlink/path traversal during extraction could lead to arbitrary file overwrite on the host.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: ip-address==10.1.0 — 2 advisory(ies): CVE-2026-69192 (ip-address: Address4 decodes leading-zero octets as decimal while resolvers deco); CVE-2026-42338 (ip-address has XSS in Address6 HTML-emitting methods)

High
Category
Supply Chain
Confidence
80% confidence
Finding

ip-address 10.1.0 is present transitively via socks handling, and the listed issues appear to be genuine package vulnerabilities. In this skill context the XSS-related functionality is likely unused server-side, and the parsing ambiguity mainly matters if IP validation decisions are security-sensitive, so impact is lower here.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: js-yaml==4.1.1 — 4 advisory(ies): CVE-2026-84375 (js-yaml: maxTotalMergeKeys does not limit CPU use for empty merge sources); CVE-2026-59869 (js-yaml: YAML merge-key chains can force quadratic CPU consumption); GHSA-5p4m-2wfm-xmqj (JS-YAML: Quadratic CPU consumption in !!omap resolution (3.x and 4.x) — CVE-2026) +1 more

High
Category
Supply Chain
Confidence
88% confidence
Finding

js-yaml 4.1.1 is a real vulnerable dependency with CPU-consumption/DoS concerns around malicious YAML parsing. The skill description mentions configuration via .deepseek.json rather than YAML, so this may only be reachable through transitive tooling, but if any YAML input is parsed it could let an attacker degrade availability of the persistent daemon.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: ws==8.20.0 — 2 advisory(ies): CVE-2026-45736 (ws: Uninitialized memory disclosure); CVE-2026-48779 (ws: Memory exhaustion DoS from tiny fragments and data chunks)

High
Category
Supply Chain
Confidence
90% confidence
Finding

ws 8.20.0 is a real vulnerable dependency and is relevant because Puppeteer/CDP automation relies on WebSocket communication. Memory disclosure or fragmentation-based memory exhaustion in a long-running automation daemon increases risk to confidentiality and availability if an attacker can interact with or influence WebSocket traffic.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.dangerous_exec, suspicious.dynamic_code_execution

Shell command execution detected (child_process).

Critical
Code
suspicious.dangerous_exec
Location
ask-puppeteer.js:112

Shell command execution detected (child_process).

Critical
Code
suspicious.dangerous_exec
Location
daemon-healthcheck.js:239

Dynamic code execution detected.

Critical
Code
suspicious.dynamic_code_execution
Location
ask-puppeteer.js:1258