Security audit

Browse

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent browser automation helper, but it gives broad browser control and documents reusable authentication state in a way users should review carefully before installing.

Install only if you intend to give the agent broad browser automation authority. Avoid using shared or sensitive accounts unless necessary, prefer isolated sessions, wipe state after use, and do not save auth state to /tmp or other shared paths; treat exported auth-state files like passwords.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.md:135
Finding: Authentication State Stored at a Predictable Shared Temporary Path
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Vague Triggers

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The skill advertises very broad trigger phrases such as 'check the page', 'QA', 'healthcheck', and effectively any task requiring a real browser. This can cause unintended invocation on common user requests, expanding the skill's reach into workflows involving authenticated browsing, form filling, uploads, and in-page code evaluation, which increases the chance of data exposure or unsafe actions being performed without explicit user intent.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The documentation highlights persistent session state, including cookies, localStorage, and auth tokens, but does not prominently warn that these artifacts are sensitive credentials. In this skill context, persistence across commands and sessions makes accidental reuse, cross-task contamination, or unsafe handling of authenticated state more likely.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The examples directly show saving and loading authentication state from a file without stating that the file may contain bearer-equivalent session material. An agent or user could treat /tmp/auth.json as routine output, leaving reusable authenticated sessions on disk where other processes or users may access them.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.