T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:20- Finding
Chrome Is Launched with Its Security Sandbox Disabled
- Content
View full analysis
- Remediation
View remediation
Security audit
xvfb-chrome
Security checks for vulnerabilities and agentic risk
Overview
The skill is a coherent Chrome/Xvfb automation guide, but it uses unsafe browser and process-management defaults that deserve review before installation.
Install only if you are comfortable managing Chrome automation security yourself. Run it under a dedicated unprivileged account, avoid personal or production-authenticated browser profiles, bind DevTools explicitly to 127.0.0.1, use a unique temporary profile directory, avoid --no-sandbox unless your isolated environment truly requires it, and replace killall/pkill examples with PID-scoped cleanup.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (3)
T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:27- Finding
Unauthenticated Chrome DevTools Control Is Enabled for a Reusable Browser Profile
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Note
- Location
SKILL.md:146- Finding
Global Process-Kill Commands Can Terminate Unrelated Chrome and Xvfb Sessions
- Content
View full analysis
/dev/null ``` ### Technical Analysis `killall chrome` and `pkill Xvfb` select processes globally by executable or process name. They do not verify that a process was created by this Skill, belongs to the intended automation session, uses the expected profile, or is attached to the relevant display. On a shared host—or under an account running multiple browser workloads—the commands can terminate unrelated browser and virtual-display sessions. This violates least-scope process management and creates an avoidable availability risk. The practical scope remains constrained by operating-system permissions: an unprivileged user ordinarily cannot signal processes owned by other users. However, all matching processes owned by the same account may be terminated. Running these commands with elevated privileges can expand the effect to system-wide matching processes. ### Attack Path 1. Multiple Chrome or Xvfb sessions run on the same host or under the same service account. 2. An operator follows the documented “kill all” or restart procedure. 3. `killall` or `pkill` matches every accessible process with the corresponding name. 4. The operating system sends termination signals to both the intended session and unrelated sessions. 5. Other automation jobs, interactive browser sessions, screenshots, or in-progress transactions are interrupted. ### Impact Assessment The primary impact is denial of service and loss of in-progress work. Affected scope includes all matching processes that the invoking account is permitted to signal. Under a shared service account, this can disrupt parallel ...[truncated 362 chars]- Remediation
View remediation
"$runtime_dir/chrome.pid" ``` - Store PID files in a private runtime directory owned by the dedicated service account. - Before signaling a recorded PID: - Confirm that it still exists. - Confirm process ownership. - Validate `/proc//cmdline` against the expected executable, profile, debugging port, and display. - Terminate only the validated PID, initially with `SIGTERM`, and use `SIGKILL` only after a bounded timeout. - Use a service manager such as systemd to place each automation instance in a dedicated service or control group and stop only that unit. - Avoid `killall`, unrestricted `pkill`, and broad regular-expression process matching in operational instructions. - Run separate automation workloads under separate unprivileged accounts where process isolation is required. ]]>
Vulnerability Patterns
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The natural-language instructions and descriptions in this skill are presented in Chinese only, which can amount to a language-policy violation when no user opt-in or alternative language is offered. The file does not state that the skill is intentionally limited to Chinese-speaking users or a specific region.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 80% confidence
- Finding
This markdown file includes an example command that saves a screenshot to
/root/screenshot.png, which affects user/system data by creating or overwriting a file. The surrounding skill description does not provide any warning about where files are written or the need to choose a safe output path.- Content
Context-Inappropriate Capability
Low
- Category
- Not specified by scanner
- Confidence
- 76% confidence
- Finding
The manifest describes running Chrome with Xvfb for browser automation and DevTools MCP connectivity. The guidance to kill all Chrome processes and all Xvfb processes system-wide (
killall chrome,pkill Xvfb) is a broader host-management capability than is necessary for that purpose and could impact unrelated workloads on the server.- Content
Static analysis
No suspicious patterns detected.