Security audit

ego-browser · Windows浏览器自动化

Security checks for vulnerabilities and agentic risk

Overview

This is a disclosed browser automation skill, but users should be careful because it can act in logged-in browser sessions and persist site notes.

Install only if you want an agent to control browser pages, including logged-in SaaS or internal sites. Use test or least-privilege accounts where possible, confirm any destructive or public action before it runs, and do not let learnings store passwords, tokens, personal data, or sensitive business content.

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The skill explicitly advertises reuse of persisted Chrome/storageState login sessions together with browser actions such as clicking, form filling, navigation, and arbitrary JavaScript execution. In an agent context, this can expose sensitive authenticated data and enable unintended account actions in already-logged-in systems, and the documentation does not provide meaningful warnings, consent gates, or usage restrictions for those risks.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The documentation states that the agent automatically persists per-domain 'experience' after successful operations and automatically reloads it later, but it provides no warning about storage, retention, or review of what may be written. In a browser automation skill, those notes could include sensitive site-specific details, workflow artifacts, or user-provided content, creating an unintended persistence and privacy risk across sessions.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The README documents a `learn(site, note)` API that appends content to files automatically, but it omits any warning that invoking it causes persistent writes. That makes it easy for an agent or integrator to store sensitive data unintentionally, and the append behavior can also accumulate unreviewed or attacker-influenced content that later affects future agent behavior on the same domain.

Static analysis

No suspicious patterns detected.