Security audit

Skill

Security checks across malware telemetry and agentic risk

Overview

This skill is a legitimate Chrome debugging helper, but its documentation normalizes giving an AI access to browser sessions, network data, and even stored tokens without enough safeguards.

Install only if you are comfortable giving your AI assistant Chrome DevTools-level access. Use a dedicated temporary Chrome profile and test accounts, avoid personal or production sessions, do not ask it to read tokens or cookies, and review the user-wide MCP install before allowing it to persist across projects.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (10)

Context-Inappropriate Capability

Medium

Confidence: 96% confidence
Finding: The guide explicitly instructs the agent to retrieve `window.localStorage.getItem('user_token')`, which is an authentication secret rather than ordinary debugging data. In a browser-control skill, this turns the tool into a credential-access mechanism and can expose bearer tokens that enable account takeover or API abuse far beyond the stated debugging need.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The skill explicitly advertises the ability to inspect network requests, response bodies, console output, and perform browser automation, but it does not warn that these capabilities can expose session tokens, API responses, PII, or data visible in authenticated browser contexts. In an AI-agent setting, this omission is security-relevant because users may invoke the skill against real logged-in sessions without understanding the data exposure and side effects.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The documentation says the server can automatically launch Chrome or attach to an existing DevTools remote-debugging port, but it does not disclose that this can grant control over a real browser session and any open tabs associated with that profile. In context, an AI assistant with browser-control privileges could affect active authenticated sessions, navigate away from user pages, trigger actions, or inspect sensitive content without the user appreciating the risk.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The guide explicitly states that AI can automatically execute an installation command that adds an MCP server with `--scope user`, which changes the current user's global tool configuration. In the context of an agent skill, encouraging automatic execution without a clear consent and scope warning increases the risk of silent persistence or broader-than-expected environment modification across projects.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: The network inspection section says the AI can view request URLs, headers, and response bodies without any warning that these often contain API keys, bearer tokens, cookies, PII, or business-sensitive payloads. Because this skill is designed to give an AI direct browser visibility, normal debugging prompts could unintentionally disclose sensitive traffic contents to the model or logs.

Missing User Warnings

Medium

Confidence: 84% confidence
Finding: The browser automation example includes typing a username and password and submitting a login flow, but provides no warning to use only test credentials or to avoid exposing production secrets to the agent. In this context, the example normalizes handing credentials to an AI-controlled browser tool, increasing the risk of secret disclosure, accidental reuse of real accounts, and unsafe logging.

Missing User Warnings

High

Confidence: 95% confidence
Finding: The JavaScript execution examples include reading from localStorage, specifically a stored token, without any warning that this is sensitive authentication data. Given the skill's direct execution capability inside a real browser, this materially increases the danger by showing users how to extract secrets rather than restrict the tool to legitimate debugging state inspection.

Missing User Warnings

Medium

Confidence: 89% confidence
Finding: The guide explicitly recommends connecting the MCP server to an already logged-in Chrome instance and a specific browser profile, which can expose authenticated sessions, cookies, local storage, browsing history, and live page content to the agent. In the context of a browser-control skill for AI assistants, this materially increases the chance of unauthorized access to sensitive user data if the agent is over-permissioned, misused, or compromised.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The troubleshooting guide tells users to launch Chrome with a persistent user profile, manually log in, and then connect MCP tooling, but it does not warn that the AI/browser tooling may gain access to authenticated pages, cookies, tokens visible in the session, screenshots, and sensitive account data. In the context of a browser-control MCP server, this omission is security-relevant because the tool is explicitly designed to inspect pages, network traffic, and browser state, making authenticated-session exposure a realistic risk.

Ssd 3

High

Confidence: 99% confidence
Finding: This line directly tells the AI to read `localStorage` for `user_token`, which is a concrete instruction to access an authentication artifact. That is dangerous because tokens can often be replayed immediately against backend services, enabling unauthorized access, impersonation, and lateral movement, and the browser-debugging context makes such access especially easy and likely to be overlooked.

VirusTotal

59/59 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.