Security audit

Lightpanda

Security checks for vulnerabilities and agentic risk

Overview

This skill is a coherent Lightpanda browser-automation guide, but it asks agents/users to run mutable, unverified browser binaries and containers with persistent integration steps that need careful review.

Install only after reviewing the exact Lightpanda release you intend to run. Prefer pinned versions or immutable Docker digests, verify checksums/signatures before chmod or execution, avoid automatic agent execution of install commands, use an isolated browser profile/container for MCP automation, and do not browse authenticated or sensitive sites unless you explicitly want the agent to access that data.

A.I.G

Vulnerability Patterns

Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions

Findings (4)

T03 · Remote Payload Retrieval and Execution

Warning

Location: guides/01-installation.md:17
Finding: Mutable Nightly Binaries Are Downloaded and Executed Without Integrity Verification
Content: View full analysis
Vulnerability Details

File Location: guides/01-installation.md:17-23, 29-33, 41-45, 50-53; SKILL.md:74-75
Vulnerability Type: Remote payload retrieval and execution
Risk Level: Medium

Vulnerable Code

bash
curl -L -o lightpanda \ https://github.com/lightpanda-io/browser/releases/download/nightly/lightpanda-x86_64-linux chmod a+x ./lightpanda ./lightpanda version

Equivalent installation instructions are provided for the other supported processor architectures and operating systems.

Technical Analysis

The instructions retrieve an executable from a mutable nightly release URL, grant it execute permission, and run it without checking a cryptographic signature or expected digest. Because the nightly artifact can change after the Skill has been reviewed, the executable that ultimately runs is not necessarily the artifact assessed during publication.

HTTPS protects the transfer in transit but does not protect against compromise of the upstream repository, release workflow, maintainer account, or artifact storage. Merely running lightpanda version is not a safe validation step because a malicious executable can perform arbitrary actions before returning a plausible version string.

Downloading a browser binary is necessary for the declared functionality. However, using a mutable release and omitting integrity verification exceeds the minimum supply-chain risk required to install that browser.

Attack Path

An attacker compromises the upstream GitHub organization, maintainer account, release workflow, or nightly artifact.

The attacker replaces one or more nightly binaries with a malicious executable.

A user or AI agent follows the Skill's installation instructions.

curl downloads the attacker-controlled artifact.

chmod a+x makes the artifact executable.

./lightpanda version or a later browser command executes the payload.

The payload performs action ...[truncated 677 chars]
Remediation: View remediation
Remediation Suggestions

Replace nightly with a reviewed, immutable release version.

Publish expected SHA-256 digests in the Skill or retrieve them from a separately authenticated release manifest.

Verify the digest before granting execute permission or running the file.

Prefer signed and notarized releases, and verify the publisher signature.

Fail closed if any integrity or identity check fails.

Avoid automatically executing downloaded artifacts; request informed user approval after displaying the source, version, and verified digest.

Keep the installation in an unprivileged directory rather than moving the binary into a system-wide path until verification succeeds.

A hardened sequence should pin an immutable release, download both the binary and its authenticated checksum or signature, verify it, and only then make the file executable.

T08 · Insecure Dependencies

Warning

Location: guides/01-installation.md:61
Finding: Mutable Nightly Container Image Is Run Without Digest or Provenance Verification
Content: View full analysis
Vulnerability Details

File Location: guides/01-installation.md:61-68; guides/02-quickstart.md:64-67; guides/03-advanced-usage.md:162-168; SKILL.md:84; troubleshooting.md:26, 65-68, 185-188
Vulnerability Type: Insecure third-party container dependency
Risk Level: Medium

Vulnerable Code

bash
docker run -d --name lightpanda \ -p 127.0.0.1:9222:9222 \ lightpanda/browser:nightly

The Docker Compose example similarly uses:

yaml
services: lightpanda: image: lightpanda/browser:nightly ports: - "127.0.0.1:9222:9222" environment: - LIGHTPANDA_DISABLE_TELEMETRY=true restart: unless-stopped

Technical Analysis

The nightly container tag is mutable and is not pinned to an immutable image digest. The instructions also do not require image-signature or provenance verification. Consequently, the actual image pulled and executed can change independently of the audited Skill.

Binding the CDP port to 127.0.0.1 is a positive least-privilege measure that avoids exposing the debugging service directly to external network interfaces. Disabling telemetry in the Compose example is also beneficial. Neither control, however, establishes the integrity of the image itself.

The examples do not mount host directories or request privileged container mode, which limits impact compared with a privileged deployment. Nevertheless, a malicious image can still execute code inside the container, communicate over the network, attack reachable services, and impersonate the expected CDP browser.

Attack Path

An attacker compromises the image publisher, registry account, build process, or mutable nightly tag.

The attacker publishes a malicious image under lightpanda/browser:nightly.

A user or AI agent runs the documented Docker or Docker Compose command.

Docker pulls and starts the attacker-controlled image.

The image executes malici ...[truncated 904 chars]
Remediation: View remediation
Remediation Suggestions

Pin the image using an immutable SHA-256 digest instead of the mutable nightly tag.

Verify image signatures and build provenance before execution.

Document the expected publisher identity and digest for each supported release.

Run the container as a dedicated non-root user.

Add a read-only root filesystem where compatible.

Drop all unnecessary Linux capabilities and enable no-new-privileges.

Retain the existing loopback-only port binding.

Avoid host filesystem mounts, Docker socket mounts, host networking, and privileged mode.

Apply outbound network restrictions when the intended browsing targets are known.

Replace restart: unless-stopped with an operationally justified policy so a compromised or malfunctioning image does not restart indefinitely.

T09 · Insecure Skill Coding Practices

Warning

Location: troubleshooting.md:40
Finding: macOS Quarantine Protection Is Removed From an Unverified Downloaded Executable
Content: View full analysis
Vulnerability Details

File Location: troubleshooting.md:40-43
Vulnerability Type: Unsafe bypass of platform executable trust controls
Risk Level: Medium

Vulnerable Code

bash
xattr -d com.apple.quarantine ./lightpanda ./lightpanda version

Technical Analysis

The troubleshooting instructions remove the com.apple.quarantine attribute from a downloaded executable and immediately run it. Quarantine metadata is part of the macOS mechanism that enables Gatekeeper to apply provenance, signing, and notarization checks to downloaded software.

Removing quarantine is not inherently malicious and may sometimes be necessary for legitimate unsigned development software. In this Skill, however, it is combined with installation instructions that do not verify a checksum, code signature, notarization ticket, or immutable release identity. It therefore converts a security warning into an execution path without first establishing that the binary is trustworthy.

The command only changes metadata on the specified local file and does not itself grant elevated operating-system privileges. The primary risk is enabling execution of a binary that macOS had identified as downloaded and potentially untrusted.

Attack Path

A user downloads a compromised, substituted, or otherwise untrusted Lightpanda binary.

macOS blocks or warns about the executable because it is quarantined or cannot be verified.

The user follows the troubleshooting instructions and deletes the quarantine attribute.

The user executes ./lightpanda version.

The malicious executable runs under the user's account and performs arbitrary actions before or instead of returning version information.

Impact Assessment

Successful exploitation results in arbitrary code execution with the invoking user's privileges. The executable may access user files, environment variables, browser automation data, developer credentials, and net ...[truncated 191 chars]
Remediation: View remediation
Remediation Suggestions

Do not present quarantine removal as the default response to a Gatekeeper warning.

Require checksum and publisher-signature verification before any quarantine change.

Prefer a properly signed and notarized macOS release.

Show users how to inspect the signature and Gatekeeper assessment before execution.

Display an explicit warning explaining that quarantine removal bypasses a platform trust checkpoint.

Pin the downloaded artifact to an immutable release.

If verification cannot be completed, instruct the user not to execute the binary.

T03 · Remote Payload Retrieval and Execution

Note

Location: guides/03-advanced-usage.md:190
Finding: Unpinned Upstream Repository Bootstrap Script Is Executed During Source Build
Content: View full analysis
Vulnerability Details

File Location: guides/03-advanced-usage.md:190-197
Vulnerability Type: Remote payload retrieval through an unpinned build bootstrap script
Risk Level: Low

Vulnerable Code

bash
git clone https://github.com/lightpanda-io/browser.git cd browser ./zig/download.sh zig build -Doptimize=ReleaseFast

Technical Analysis

The instructions clone the current default branch rather than an immutable reviewed tag or commit and then execute ./zig/download.sh. Both the script and the resources it retrieves can therefore differ from those present when this Skill was audited.

Executing a repository-provided bootstrap script is common in source builds, but it establishes a remote code execution channel when the repository revision and dependency artifacts are not pinned and verified. The audit cannot establish the behavior of future versions of that script because the script is not included in this Skill package.

This finding is rated Low because the source-build path is explicitly described as optional and intended only for users needing recent features or custom modifications. Exploitation still yields code execution if a compromised upstream revision is used.

Attack Path

An attacker compromises the upstream default branch, maintainer account, or dependency infrastructure used by zig/download.sh.

The attacker changes the bootstrap script or an artifact retrieved by it.

A user follows the source-build instructions and clones the current default branch.

The user executes ./zig/download.sh.

The modified script or downloaded component executes attacker-controlled commands with the user's privileges.

A malicious build output may subsequently be installed or used as the trusted browser binary.

Impact Assessment

A malicious bootstrap script can execute arbitrary commands with the privileges of the account performing the build. It could read or mod ...[truncated 345 chars]
Remediation: View remediation
Remediation Suggestions

Clone a specific reviewed release tag and verify the corresponding commit hash.

Verify the tag or commit signature against a documented maintainer identity.

Inspect zig/download.sh before execution and document its expected behavior.

Pin every downloaded build dependency by version and cryptographic digest.

Run the build in an isolated, unprivileged container or sandbox without access to user credentials.

Restrict outbound network access to the dependency hosts required for the build.

Verify the resulting binary against reproducible-build metadata or an independently published digest when available.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
YARA SignaturesMalware Match, Webshell Match, Cryptominer Match
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (26)

YARA rule 'backdoor_persistence': Backdoor persistence with malicious payloads (shell commands, SSH key injection, hidden root users) [malware]

High

Category: YARA Match
Confidence: 75% confidence
Finding: YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).
Content: Scanner excerpt · guides/03-advanced-usage.md (reported line 209)May include surrounding context.
（必须是精确版本）

从 https://ziglang.org/download/ 下载

克隆仓库

git clone https://github.com/lightpanda-io/browser.git cd browser

下载子依赖

./zig/download.sh

构建（耗时较长）

zig build -Doptimize=ReleaseFast

二进制位于 zig-out/bin/lightpanda

./zig-out/bin/lightpanda version

text
--- ## 遥测控制 ```bash # 永久禁用（推荐生产环境） echo 'export LIGHTPANDA_DISABLE_TELEMETRY=true' >> ~/.bashrc source ~/.bashrc # 单次禁用 LIGHTPANDA_DISABLE_TELEMETRY=true ./lightpanda serve

完成确认检查清单

Playwright 脚本通过 connectOverCDP 成功连接并执行操作

代理配置后目标页面返回正确内容（可选）

高并发场景下内存稳定（对比 Headless Chrome 有明显改善）

Docker Compose 部署正常（生产场景）

相关链接

故障排查

完整文档

[MCP 服务器文档](https://li

External Script Fetching

High

Category: Supply Chain
Confidence: 90% confidence
Finding: Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
Content: Scanner excerpt · troubleshooting.md (reported line 232)May include surrounding context.
md
./lightpanda fetch --dump markdown https://example.com | head -10 # 检查 CDP 服务器健康状态 curl -s http://127.0.0.1:9222/json/version | python3 -m json.tool # 查看详细日志 ./lightpanda serve \

Rp1

Medium

Category: MCP Rug Pull
Confidence: 70% confidence
Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The skill advertises web fetching, browser automation, proxies, cookie handling, and network interception without warning that visited content, credentials, session cookies, and browsing targets may be transmitted to third parties or manipulated by the browser workflow. In an AI-agent context, users may not realize the privacy and security implications of granting these capabilities.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The MCP setup grants an AI tool direct browser control, enabling navigation, interaction, and data extraction on the user's behalf. Without a warning, users may unknowingly allow the agent to perform state-changing actions on websites, access authenticated content, or leak session data.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 90% confidence
Finding: The skill recommends running lightpanda/browser:nightly, which is a floating tag rather than a pinned immutable digest. A changed or compromised image behind nightly could silently alter behavior over time and cause users or agents to run unreviewed code.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 88% confidence
Finding: The skill instructs users to download and execute a remote binary directly from a release URL and then use it to fetch external web content. This creates supply-chain and external transmission risk, especially because the binary is not integrity-verified and the tool is intended for automated browsing and content retrieval.
Content: Scanner excerpt · SKILL.md (reported line 74)May include surrounding context.
bash
# 下载安装（macOS） curl -L -o lightpanda https://github.com/lightpanda-io/browser/releases/download/nightly/lightpanda-aarch64-macos chmod a+x ./lightpanda # 转储网页为 Markdown

Rp1

Medium

Category: MCP Rug Pull
Confidence: 94% confidence
Finding: The Docker example runs lightpanda/browser:nightly, again relying on a mutable tag. For an agent skill that may be executed automatically, this increases supply-chain risk because future pulls may not match what was originally reviewed.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The guide explicitly labels the installation commands as 'AI 可自动执行' while instructing the agent to download a remote binary, mark it executable, and run it with no integrity verification or warning. In an agent-execution context this is more dangerous than ordinary documentation because it encourages unattended execution of network-fetched code.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 95% confidence
Finding: The instructions download an executable from the internet and immediately make it executable and run it, with no checksum, signature verification, or release pinning beyond a mutable nightly path. This is a classic remote-code execution and supply-chain exposure, especially dangerous in an agent skill where commands may be executed automatically.
Content: Scanner excerpt · guides/01-installation.md (reported line 17)May include surrounding context.
bash
# 下载 nightly 版本 curl -L -o lightpanda \ https://github.com/lightpanda-io/browser/releases/download/nightly/lightpanda-x86_64-linux # 添加执行权限

Rp1

Medium

Category: MCP Rug Pull
Confidence: 94% confidence
Finding: The Docker example uses the mutable tag lightpanda/browser:nightly rather than a pinned immutable version or digest. This creates a supply-chain risk because future pulls may fetch different content than what was originally reviewed, and an AI agent or user following the guide cannot reproduce or verify exactly what image is being executed.
Content: No source excerpt is available for this finding.

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 89% confidence
Finding: The sudo mv lightpanda /usr/local/bin/ step performs a privileged filesystem modification, moving a previously downloaded binary into a trusted system PATH location. If the binary is malicious or tampered with, this elevates persistence and trust, making accidental or malicious execution more likely across the system.
Content: Scanner excerpt · guides/01-installation.md (reported line 94)May include surrounding context.
bash
# 将二进制移到系统 PATH sudo mv lightpanda /usr/local/bin/ # 任意目录下都可使用 lightpanda version

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The quickstart encourages web fetching, crawling, and MCP/AI-driven browsing and extraction, but provides no warning about authorization boundaries, robots/ToS compliance beyond one optional flag, or the risk of exposing sensitive page contents to AI tools and browser automation pipelines. In the context of an agent-oriented browser with MCP integration, this omission can lead users to collect or transmit private, internal, or regulated data without realizing the security and privacy implications.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 75% confidence
Finding: Docker image references without a specific tag (:latest is implicit) or digest (@sha256:...) can be silently replaced by a malicious image.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 75% confidence
Finding: Docker image references without a specific tag (:latest is implicit) or digest (@sha256:...) can be silently replaced by a malicious image.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 75% confidence
Finding: Docker image references without a specific tag (:latest is implicit) or digest (@sha256:...) can be silently replaced by a malicious image.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The documentation shows credentials and bearer tokens being passed directly on the command line, which commonly exposes secrets through shell history, process listings, CI logs, and shared terminal recordings. In an agent/automation context, this pattern is more dangerous because such commands are often generated, logged, or reused automatically, increasing accidental credential disclosure risk.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 75% confidence
Finding: Docker image references without a specific tag (:latest is implicit) or digest (@sha256:...) can be silently replaced by a malicious image.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The instructions tell users to remove the macOS quarantine attribute from a downloaded binary without any warning about bypassing Gatekeeper protections. This lowers an important OS trust barrier and can lead users to execute an unverified or tampered binary, especially dangerous in an AI/automation browser tool context where binaries may be downloaded and run quickly.
Content: No source excerpt is available for this finding.

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · troubleshooting.md (reported line 62)May include surrounding context.
解决方案：

bash
# Ubuntu/Debian 安装常见依赖 sudo apt-get update sudo apt-get install -y libcurl4 libssl3 # 如果仍有缺失，使用 Docker 镜像

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · troubleshooting.md (reported line 63)May include surrounding context.
解决方案：

bash
# Ubuntu/Debian 安装常见依赖 sudo apt-get update sudo apt-get install -y libcurl4 libssl3 # 如果仍有缺失，使用 Docker 镜像

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The WSL2 instructions direct users to run wsl --install from an administrator PowerShell session and reboot, but do not clearly warn about the privileged, system-modifying nature of the action. While common for setup docs, this is still risky in an agent skill because it may trigger major host configuration changes without sufficiently explicit user consent.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 98% confidence
Finding: A language-specific skill description can violate language/locale policy when it forces one language without user opt-in or justification. This file presents all instructions exclusively in Chinese and does not indicate that the guide is intended only for a Chinese-speaking audience or provide an alternative language option.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 88% confidence
Finding: 文件标题与全部说明内容均为中文，没有提供多语言选项、用户选择机制，亦未说明这是特定区域或语言版本文档。根据 SQP-3，未经用户选择而强制特定语言可能构成语言/地区策略问题。
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 79% confidence
Finding: “AI 智能体场景：批量页面爬取”示例演示并发抓取大量页面并提取正文内容，这属于可能影响第三方系统与数据处理的行为。该 markdown 片段强调性能与并发，但未附带任何关于遵守站点条款、robots/访问频率限制或处理抓取数据的提示，因此构成缺失用户警告。
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.

Overview

A.I.G

T03 · Remote Payload Retrieval and Execution

Vulnerability Details

Vulnerable Code

Technical Analysis

Attack Path

Remediation Suggestions

T08 · Insecure Dependencies

Vulnerability Details

Vulnerable Code

Technical Analysis

Attack Path

Remediation Suggestions

T09 · Insecure Skill Coding Practices

Vulnerability Details

Vulnerable Code

Technical Analysis

Attack Path

Impact Assessment

Remediation Suggestions

T03 · Remote Payload Retrieval and Execution

Vulnerability Details

Vulnerable Code

Technical Analysis

Attack Path

Impact Assessment

Remediation Suggestions

SkillSpector

YARA rule 'backdoor_persistence': Backdoor persistence with malicious payloads (shell commands, SSH key injection, hidden root users) [malware]

从 https://ziglang.org/download/ 下载

克隆仓库

下载子依赖

构建（耗时较长）

二进制位于 zig-out/bin/lightpanda

完成确认检查清单

相关链接

External Script Fetching

Rp1

Missing User Warnings

Missing User Warnings

Rp1

External Transmission

Rp1

Missing User Warnings

External Transmission

Rp1

Sudo/Root Execution

Missing User Warnings

Rp1

Rp1

Rp1

Missing User Warnings

Rp1

Missing User Warnings

Sudo/Root Execution

Sudo/Root Execution

Missing User Warnings

Natural-Language Policy Violations

Natural-Language Policy Violations

Missing User Warnings

Static analysis